theory CSpace_C

lemma sameRegionAs_spec:
  "\<forall>capa capb. \<Gamma> \<turnstile> \<lbrace>ccap_relation capa \<acute>cap_a \<and>
                     ccap_relation capb \<acute>cap_b \<and>
                     capAligned capb \<and> (\<exists>s. s \<turnstile>' capa)\<rbrace>
  Call sameRegionAs_'proc
  \<lbrace> \<acute>ret__unsigned_long = from_bool (sameRegionAs capa capb) \<rbrace>" apply vcg apply clarsimp apply (simp add: sameRegionAs_def isArchCap_tag_def2) apply (case_tac capa, simp_all add: cap_get_tag_isCap_unfolded_H_cap isCap_simps)
            \<comment> \<open>capa is a ThreadCap\<close> apply (case_tac capb,
                    simp_all add: cap_get_tag_isCap_unfolded_H_cap isCap_simps cap_tag_defs)[1] apply (frule_tac cap'=cap_a in cap_get_tag_isCap_unfolded_H_cap(1)) apply (frule_tac cap'=cap_b in cap_get_tag_isCap_unfolded_H_cap(1)) apply (simp add: ccap_relation_def map_option_case) apply (simp add: cap_thread_cap_lift) apply (simp add: cap_to_H_def) apply (clarsimp simp: from_bool_0 split: if_split) apply (clarsimp simp: case_bool_If ctcb_ptr_to_tcb_ptr_def if_distrib
                              cong: if_cong) apply (frule_tac cap'=cap_b in cap_get_tag_isArchCap_unfolded_H_cap) apply (clarsimp simp: isArchCap_tag_def2)
           \<comment> \<open>capa is a NullCap\<close> apply (simp add: cap_tag_defs)
          \<comment> \<open>capa is an NotificationCap\<close> apply (case_tac capb,
                  simp_all add: cap_get_tag_isCap_unfolded_H_cap isCap_simps cap_tag_defs)[1] apply (frule_tac cap'=cap_a in cap_get_tag_isCap_unfolded_H_cap(3)) apply (frule_tac cap'=cap_b in cap_get_tag_isCap_unfolded_H_cap(3)) apply (simp add: ccap_relation_def map_option_case) apply (simp add: cap_notification_cap_lift) apply (simp add: cap_to_H_def) apply (clarsimp split: if_split) apply (frule_tac cap'=cap_b in cap_get_tag_isArchCap_unfolded_H_cap) apply (clarsimp simp: isArchCap_tag_def2)
          \<comment> \<open>capa is an IRQHandlerCap\<close> apply (case_tac capb,
                 simp_all add: cap_get_tag_isCap_unfolded_H_cap isCap_simps cap_tag_defs)[1] apply (frule_tac cap'=cap_a in cap_get_tag_isCap_unfolded_H_cap(5)) apply (frule_tac cap'=cap_b in cap_get_tag_isCap_unfolded_H_cap(5)) apply (simp add: ccap_relation_def map_option_case) apply (simp add: cap_irq_handler_cap_lift) apply (simp add: cap_to_H_def) apply (clarsimp simp: up_ucast_inj_eq c_valid_cap_def
                                 cl_valid_cap_def mask_twice from_bool_0
                          split: if_split bool.split
                          | intro impI conjI
                          | simp )+ apply (drule ucast_ucast_mask_eq, simp) apply (simp add: ucast_ucast_mask) apply (frule_tac cap'=cap_b in cap_get_tag_isArchCap_unfolded_H_cap) apply (clarsimp simp: isArchCap_tag_def2)
         \<comment> \<open>capa is an EndpointCap\<close> apply (case_tac capb, simp_all add: cap_get_tag_isCap_unfolded_H_cap
                                             isCap_simps cap_tag_defs)[1] apply (frule_tac cap'=cap_a in cap_get_tag_isCap_unfolded_H_cap(4)) apply (frule_tac cap'=cap_b in cap_get_tag_isCap_unfolded_H_cap(4)) apply (simp add: ccap_relation_def map_option_case) apply (simp add: cap_endpoint_cap_lift) apply (simp add: cap_to_H_def) apply (clarsimp simp: from_bool_0 split: if_split) apply (frule_tac cap'=cap_b in cap_get_tag_isArchCap_unfolded_H_cap) apply (clarsimp simp: isArchCap_tag_def2)
        \<comment> \<open>capa is a DomainCap\<close> apply (case_tac capb, simp_all add: cap_get_tag_isCap_unfolded_H_cap
                                            isCap_simps cap_tag_defs)[1] apply (frule_tac cap'=cap_b in cap_get_tag_isArchCap_unfolded_H_cap) apply (fastforce simp: isArchCap_tag_def2 split: if_split)
       \<comment> \<open>capa is a Zombie\<close> apply (simp add: cap_tag_defs)
      \<comment> \<open>capa is an Arch object cap\<close> apply (frule_tac cap'=cap_a in cap_get_tag_isArchCap_unfolded_H_cap) apply (clarsimp simp: isArchCap_tag_def2 cap_tag_defs linorder_not_less [THEN sym]) apply (rule conjI, clarsimp, rule impI)+ apply (case_tac capb, simp_all add: cap_get_tag_isCap_unfolded_H_cap
                                          isCap_simps cap_tag_defs)[1]
      \<comment> \<open>capb is an Arch object cap\<close> apply (frule_tac cap'=cap_b in cap_get_tag_isArchCap_unfolded_H_cap) apply (fastforce simp: isArchCap_tag_def2 cap_tag_defs linorder_not_less [THEN sym])
     \<comment> \<open>capa is a ReplyCap\<close> apply (case_tac capb, simp_all add: cap_get_tag_isCap_unfolded_H_cap
                                         isCap_simps cap_tag_defs)[1] apply (frule_tac cap'=cap_b in cap_get_tag_isArchCap_unfolded_H_cap) apply (clarsimp simp: isArchCap_tag_def2) apply (frule_tac cap'=cap_a in cap_get_tag_isCap_unfolded_H_cap(8)) apply (frule_tac cap'=cap_b in cap_get_tag_isCap_unfolded_H_cap(8)) apply (simp add: ccap_relation_def map_option_case) apply (simp add: cap_reply_cap_lift) apply (simp add: cap_to_H_def ctcb_ptr_to_tcb_ptr_def) apply (clarsimp simp: from_bool_0 split: if_split)
    \<comment> \<open>capa is an UntypedCap\<close> apply (frule_tac cap'=cap_a in cap_get_tag_isCap_unfolded_H_cap(9)) apply (intro conjI) apply (rule impI, intro conjI) apply (rule impI, drule(1) cap_get_tag_to_H)+ apply (clarsimp simp: capAligned_def word_bits_conv
                              objBits_simps' get_capZombieBits_CL_def
                              Let_def word_less_nat_alt less_mask_eq
                       split: if_split_asm) apply (subgoal_tac "capBlockSize_CL (cap_untyped_cap_lift cap_a) \<le> 0x1F") apply (simp add: word_le_make_less) apply (simp add: cap_untyped_cap_lift_def cap_lift_def
                        cap_tag_defs word_and_le1 mask_def) apply (clarsimp simp: get_capSizeBits_valid_shift_word) apply (clarsimp simp: from_bool_def Let_def split: if_split bool.splits) apply (subst unat_of_nat32,
              clarsimp simp: unat_of_nat32 word_bits_def
                      dest!: get_capSizeBits_valid_shift)+ apply (clarsimp simp: ccap_relation_get_capPtr_physical
                           ccap_relation_get_capIsPhysical[symmetric]
                           ccap_relation_get_capSizeBits_physical) apply (intro conjI impI) apply ((clarsimp simp: ccap_relation_def map_option_case
                               cap_untyped_cap_lift cap_to_H_def
                               field_simps valid_cap'_def)+)[4] apply (rule impI, simp add: from_bool_0 ccap_relation_get_capIsPhysical[symmetric])
   \<comment> \<open>capa is a CNodeCap\<close> apply (case_tac capb, simp_all add: cap_get_tag_isCap_unfolded_H_cap
                                       isCap_simps cap_tag_defs)[1] apply (frule_tac cap'=cap_b in cap_get_tag_isArchCap_unfolded_H_cap) apply (clarsimp simp: isArchCap_tag_def2) apply (frule_tac cap'=cap_a in cap_get_tag_isCap_unfolded_H_cap(10)) apply (frule_tac cap'=cap_b in cap_get_tag_isCap_unfolded_H_cap(10)) apply (simp add: ccap_relation_def map_option_case) apply (simp add: cap_cnode_cap_lift) apply (simp add: cap_to_H_def) apply (clarsimp simp: from_bool_0 split: if_split bool.split)
  \<comment> \<open>capa is an IRQControlCap\<close> apply (case_tac capb, simp_all add: cap_get_tag_isCap_unfolded_H_cap isCap_simps cap_tag_defs)[1] apply (frule_tac cap'=cap_b in cap_get_tag_isArchCap_unfolded_H_cap) apply (fastforce simp: isArchCap_tag_def2 split: if_split) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<forall>capa capb. \<Gamma>\<turnstile> \<lbrace>ccap_relation capa \<acute>cap_a \<and> ccap_relation capb \<acute>cap_b \<and> capAligned capb \<and> (\<exists>s. valid_cap' capa s)\<rbrace> Call sameRegionAs_'proc \<lbrace>\<acute>ret__unsigned_long = from_bool (global.sameRegionAs capa capb)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>capa capb cap_b cap_a. \<lbrakk>ccap_relation capa cap_a; ccap_relation capb cap_b; capAligned capb; Ex (valid_cap' capa)\<rbrakk> \<Longrightarrow> \<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (\<forall>ret__unsigned_long. ret__unsigned_long = from_bool (get_capIsPhysical_CL (cap_lift cap_b)) \<longrightarrow> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) \<noteq> 0 \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = capPtr_CL (cap_untyped_cap_lift cap_a) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> (\<forall>ret__ptr_to_void. ret__ptr_to_void = get_capPtr_CL (cap_lift cap_b) \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = capBlockSize_CL (cap_untyped_cap_lift cap_a) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift cap_a) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) \<longrightarrow> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> SCAST(32 signed \<rightarrow> 32) (if ptr_val (PTR(32 word) (UCAST(32 \<rightarrow> 32) (capPtr_CL (cap_untyped_cap_lift cap_a)))) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + ((1 << unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b)))) - 1) \<le> ptr_val (PTR(32 word) (UCAST(32 \<rightarrow> 32) (capPtr_CL (cap_untyped_cap_lift cap_a)))) + ((1 << unat (capBlockSize_CL (cap_untyped_cap_lift cap_a))) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + ((1 << unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b)))) - 1) then 1 else 0) = from_bool (global.sameRegionAs capa capb)))))) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) false = from_bool (global.sameRegionAs capa capb)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = capEPPtr_CL (cap_endpoint_cap_lift cap_a) \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = capEPPtr_CL (cap_endpoint_cap_lift cap_b) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then 1 else 0) = from_bool (global.sameRegionAs capa capb)))) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> SCAST(32 signed \<rightarrow> 32) false = from_bool (global.sameRegionAs capa capb)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = capNtfnPtr_CL (cap_notification_cap_lift cap_a) \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = capNtfnPtr_CL (cap_notification_cap_lift cap_b) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then 1 else 0) = from_bool (global.sameRegionAs capa capb)))) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> SCAST(32 signed \<rightarrow> 32) false = from_bool (global.sameRegionAs capa capb)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> ((if capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) then 1 else 0) \<noteq> 0 \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = capCNodeRadix_CL (cap_cnode_cap_lift cap_a) \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then 1 else 0) = from_bool (global.sameRegionAs capa capb)))) \<and> ((if capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) then 1 else 0) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) 0 = from_bool (global.sameRegionAs capa capb))))) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> SCAST(32 signed \<rightarrow> 32) false = from_bool (global.sameRegionAs capa capb)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then 1 else 0) = from_bool (global.sameRegionAs capa capb)))) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> SCAST(32 signed \<rightarrow> 32) false = from_bool (global.sameRegionAs capa capb)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then 1 else 0) = from_bool (global.sameRegionAs capa capb)))) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> SCAST(32 signed \<rightarrow> 32) false = from_bool (global.sameRegionAs capa capb)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> SCAST(32 signed \<rightarrow> 32) true = from_bool (global.sameRegionAs capa capb)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> SCAST(32 signed \<rightarrow> 32) false = from_bool (global.sameRegionAs capa capb)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> ((if cap_get_tag cap_b = cap_get_tag cap_a then 1 else 0) \<noteq> 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) true = from_bool (global.sameRegionAs capa capb)) \<and> ((if cap_get_tag cap_b = cap_get_tag cap_a then 1 else 0) = 0 \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> ((if cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap then 1 else 0) \<noteq> 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) true = from_bool (global.sameRegionAs capa capb)) \<and> ((if cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap then 1 else 0) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) false = from_bool (global.sameRegionAs capa capb)))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = capIRQ_CL (cap_irq_handler_cap_lift cap_a) \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = capIRQ_CL (cap_irq_handler_cap_lift cap_b) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) (if UCAST(32 \<rightarrow> 32) (capIRQ_CL (cap_irq_handler_cap_lift cap_a)) = UCAST(32 \<rightarrow> 32) (capIRQ_CL (cap_irq_handler_cap_lift cap_b)) then 1 else 0) = from_bool (global.sameRegionAs capa capb)))) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> SCAST(32 signed \<rightarrow> 32) false = from_bool (global.sameRegionAs capa capb)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (\<forall>ret__unsigned_long. ret__unsigned_long = from_bool (isArchCap_tag (cap_get_tag cap_a)) \<longrightarrow> ((if from_bool (isArchCap_tag (cap_get_tag cap_a)) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> (\<forall>ret__unsigned_long. ret__unsigned_long = from_bool (isArchCap_tag (cap_get_tag cap_b)) \<longrightarrow> ((if from_bool (isArchCap_tag (cap_get_tag cap_b)) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = from_bool (Arch.sameRegionAs capaa capba) \<longrightarrow> from_bool (Arch.sameRegionAs capaa capba) = from_bool (global.sameRegionAs capa capb))))) \<and> ((if from_bool (isArchCap_tag (cap_get_tag cap_b)) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) false = from_bool (global.sameRegionAs capa capb)))) \<and> ((if from_bool (isArchCap_tag (cap_get_tag cap_a)) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) false = from_bool (global.sameRegionAs capa capb)))))))))))) proof (prove)
goal (1 subgoal):
 1. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capa cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capa x\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (global.sameRegionAs capa capb)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> global.sameRegionAs capa capb)) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (global.sameRegionAs capa capb)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> global.sameRegionAs capa capb)) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (global.sameRegionAs capa capb)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> global.sameRegionAs capa capb)) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (global.sameRegionAs capa capb)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (global.sameRegionAs capa capb) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> global.sameRegionAs capa capb)) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (global.sameRegionAs capa capb)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> global.sameRegionAs capa capb)) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (global.sameRegionAs capa capb)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> global.sameRegionAs capa capb)) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> global.sameRegionAs capa capb) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> global.sameRegionAs capa capb)) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> global.sameRegionAs capa capb) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> global.sameRegionAs capa capb) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> global.sameRegionAs capa capb))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (global.sameRegionAs capa capb)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> global.sameRegionAs capa capb)) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (isArchCap_tag (cap_get_tag cap_a) \<longrightarrow> (isArchCap_tag (cap_get_tag cap_b) \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = global.sameRegionAs capa capb))) \<and> (\<not> isArchCap_tag (cap_get_tag cap_b) \<longrightarrow> \<not> global.sameRegionAs capa capb)) \<and> (\<not> isArchCap_tag (cap_get_tag cap_a) \<longrightarrow> \<not> global.sameRegionAs capa capb)))))))))) proof (prove)
goal (1 subgoal):
 1. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capa cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capa x\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if isUntypedCap capa then let baseA = capPtr capa; topA = baseA + PPtr (HaskellLib_H.bit $ capBlockSize capa) - 1; baseB = global.capUntypedPtr capb; topB = baseB + PPtr (global.capUntypedSize capb) - 1 in global.isPhysicalCap capb \<and> baseA \<le> baseB \<and> topB \<le> topA \<and> baseB \<le> topB else if isEndpointCap capa \<and> isEndpointCap capb then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if isUntypedCap capa then let baseA = capPtr capa; topA = baseA + PPtr (HaskellLib_H.bit $ capBlockSize capa) - 1; baseB = global.capUntypedPtr capb; topB = baseB + PPtr (global.capUntypedSize capb) - 1 in global.isPhysicalCap capb \<and> baseA \<le> baseB \<and> topB \<le> topA \<and> baseB \<le> topB else if isEndpointCap capa \<and> isEndpointCap capb then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if isUntypedCap capa then let baseA = capPtr capa; topA = baseA + PPtr (HaskellLib_H.bit $ capBlockSize capa) - 1; baseB = global.capUntypedPtr capb; topB = baseB + PPtr (global.capUntypedSize capb) - 1 in global.isPhysicalCap capb \<and> baseA \<le> baseB \<and> topB \<le> topA \<and> baseB \<le> topB else if isEndpointCap capa \<and> isEndpointCap capb then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if isUntypedCap capa then let baseA = capPtr capa; topA = baseA + PPtr (HaskellLib_H.bit $ capBlockSize capa) - 1; baseB = global.capUntypedPtr capb; topB = baseB + PPtr (global.capUntypedSize capb) - 1 in global.isPhysicalCap capb \<and> baseA \<le> baseB \<and> topB \<le> topA \<and> baseB \<le> topB else if isEndpointCap capa \<and> isEndpointCap capb then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if isUntypedCap capa then let baseA = capPtr capa; topA = baseA + PPtr (HaskellLib_H.bit $ capBlockSize capa) - 1; baseB = global.capUntypedPtr capb; topB = baseB + PPtr (global.capUntypedSize capb) - 1 in global.isPhysicalCap capb \<and> baseA \<le> baseB \<and> topB \<le> topA \<and> baseB \<le> topB else if isEndpointCap capa \<and> isEndpointCap capb then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if isUntypedCap capa then let baseA = capPtr capa; topA = baseA + PPtr (HaskellLib_H.bit $ capBlockSize capa) - 1; baseB = global.capUntypedPtr capb; topB = baseB + PPtr (global.capUntypedSize capb) - 1 in global.isPhysicalCap capb \<and> baseA \<le> baseB \<and> topB \<le> topA \<and> baseB \<le> topB else if isEndpointCap capa \<and> isEndpointCap capb then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if isUntypedCap capa then let baseA = capPtr capa; topA = baseA + PPtr (HaskellLib_H.bit $ capBlockSize capa) - 1; baseB = global.capUntypedPtr capb; topB = baseB + PPtr (global.capUntypedSize capb) - 1 in global.isPhysicalCap capb \<and> baseA \<le> baseB \<and> topB \<le> topA \<and> baseB \<le> topB else if isEndpointCap capa \<and> isEndpointCap capb then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if isUntypedCap capa then let baseA = capPtr capa; topA = baseA + PPtr (HaskellLib_H.bit $ capBlockSize capa) - 1; baseB = global.capUntypedPtr capb; topB = baseB + PPtr (global.capUntypedSize capb) - 1 in global.isPhysicalCap capb \<and> baseA \<le> baseB \<and> topB \<le> topA \<and> baseB \<le> topB else if isEndpointCap capa \<and> isEndpointCap capb then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if isUntypedCap capa then let baseA = capPtr capa; topA = baseA + PPtr (HaskellLib_H.bit $ capBlockSize capa) - 1; baseB = global.capUntypedPtr capb; topB = baseB + PPtr (global.capUntypedSize capb) - 1 in global.isPhysicalCap capb \<and> baseA \<le> baseB \<and> topB \<le> topA \<and> baseB \<le> topB else if isEndpointCap capa \<and> isEndpointCap capb then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if isUntypedCap capa then let baseA = capPtr capa; topA = baseA + PPtr (HaskellLib_H.bit $ capBlockSize capa) - 1; baseB = global.capUntypedPtr capb; topB = baseB + PPtr (global.capUntypedSize capb) - 1 in global.isPhysicalCap capb \<and> baseA \<le> baseB \<and> topB \<le> topA \<and> baseB \<le> topB else if isEndpointCap capa \<and> isEndpointCap capb then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if isUntypedCap capa then let baseA = capPtr capa; topA = baseA + PPtr (HaskellLib_H.bit $ capBlockSize capa) - 1; baseB = global.capUntypedPtr capb; topB = baseB + PPtr (global.capUntypedSize capb) - 1 in global.isPhysicalCap capb \<and> baseA \<le> baseB \<and> topB \<le> topA \<and> baseB \<le> topB else if isEndpointCap capa \<and> isEndpointCap capb then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if isUntypedCap capa then let baseA = capPtr capa; topA = baseA + PPtr (HaskellLib_H.bit $ capBlockSize capa) - 1; baseB = global.capUntypedPtr capb; topB = baseB + PPtr (global.capUntypedSize capb) - 1 in global.isPhysicalCap capb \<and> baseA \<le> baseB \<and> topB \<le> topA \<and> baseB \<le> topB else if isEndpointCap capa \<and> isEndpointCap capb then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if isUntypedCap capa then let baseA = capPtr capa; topA = baseA + PPtr (HaskellLib_H.bit $ capBlockSize capa) - 1; baseB = global.capUntypedPtr capb; topB = baseB + PPtr (global.capUntypedSize capb) - 1 in global.isPhysicalCap capb \<and> baseA \<le> baseB \<and> topB \<le> topA \<and> baseB \<le> topB else if isEndpointCap capa \<and> isEndpointCap capb then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if isUntypedCap capa then let baseA = capPtr capa; topA = baseA + PPtr (HaskellLib_H.bit $ capBlockSize capa) - 1; baseB = global.capUntypedPtr capb; topB = baseB + PPtr (global.capUntypedSize capb) - 1 in global.isPhysicalCap capb \<and> baseA \<le> baseB \<and> topB \<le> topA \<and> baseB \<le> topB else if isEndpointCap capa \<and> isEndpointCap capb then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if isUntypedCap capa then let baseA = capPtr capa; topA = baseA + PPtr (HaskellLib_H.bit $ capBlockSize capa) - 1; baseB = global.capUntypedPtr capb; topB = baseB + PPtr (global.capUntypedSize capb) - 1 in global.isPhysicalCap capb \<and> baseA \<le> baseB \<and> topB \<le> topA \<and> baseB \<le> topB else if isEndpointCap capa \<and> isEndpointCap capb then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if isUntypedCap capa then let baseA = capPtr capa; topA = baseA + PPtr (HaskellLib_H.bit $ capBlockSize capa) - 1; baseB = global.capUntypedPtr capb; topB = baseB + PPtr (global.capUntypedSize capb) - 1 in global.isPhysicalCap capb \<and> baseA \<le> baseB \<and> topB \<le> topA \<and> baseB \<le> topB else if isEndpointCap capa \<and> isEndpointCap capb then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if isUntypedCap capa then let baseA = capPtr capa; topA = baseA + PPtr (HaskellLib_H.bit $ capBlockSize capa) - 1; baseB = global.capUntypedPtr capb; topB = baseB + PPtr (global.capUntypedSize capb) - 1 in global.isPhysicalCap capb \<and> baseA \<le> baseB \<and> topB \<le> topA \<and> baseB \<le> topB else if isEndpointCap capa \<and> isEndpointCap capb then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if isUntypedCap capa then let baseA = capPtr capa; topA = baseA + PPtr (HaskellLib_H.bit $ capBlockSize capa) - 1; baseB = global.capUntypedPtr capb; topB = baseB + PPtr (global.capUntypedSize capb) - 1 in global.isPhysicalCap capb \<and> baseA \<le> baseB \<and> topB \<le> topA \<and> baseB \<le> topB else if isEndpointCap capa \<and> isEndpointCap capb then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if isUntypedCap capa then let baseA = capPtr capa; topA = baseA + PPtr (HaskellLib_H.bit $ capBlockSize capa) - 1; baseB = global.capUntypedPtr capb; topB = baseB + PPtr (global.capUntypedSize capb) - 1 in global.isPhysicalCap capb \<and> baseA \<le> baseB \<and> topB \<le> topA \<and> baseB \<le> topB else if isEndpointCap capa \<and> isEndpointCap capb then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if isUntypedCap capa then let baseA = capPtr capa; topA = baseA + PPtr (HaskellLib_H.bit $ capBlockSize capa) - 1; baseB = global.capUntypedPtr capb; topB = baseB + PPtr (global.capUntypedSize capb) - 1 in global.isPhysicalCap capb \<and> baseA \<le> baseB \<and> topB \<le> topA \<and> baseB \<le> topB else if isEndpointCap capa \<and> isEndpointCap capb then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if isUntypedCap capa then let baseA = capPtr capa; topA = baseA + PPtr (HaskellLib_H.bit $ capBlockSize capa) - 1; baseB = global.capUntypedPtr capb; topB = baseB + PPtr (global.capUntypedSize capb) - 1 in global.isPhysicalCap capb \<and> baseA \<le> baseB \<and> topB \<le> topA \<and> baseB \<le> topB else if isEndpointCap capa \<and> isEndpointCap capb then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if isUntypedCap capa then let baseA = capPtr capa; topA = baseA + PPtr (HaskellLib_H.bit $ capBlockSize capa) - 1; baseB = global.capUntypedPtr capb; topB = baseB + PPtr (global.capUntypedSize capb) - 1 in global.isPhysicalCap capb \<and> baseA \<le> baseB \<and> topB \<le> topA \<and> baseB \<le> topB else if isEndpointCap capa \<and> isEndpointCap capb then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if isUntypedCap capa then let baseA = capPtr capa; topA = baseA + PPtr (HaskellLib_H.bit $ capBlockSize capa) - 1; baseB = global.capUntypedPtr capb; topB = baseB + PPtr (global.capUntypedSize capb) - 1 in global.isPhysicalCap capb \<and> baseA \<le> baseB \<and> topB \<le> topA \<and> baseB \<le> topB else if isEndpointCap capa \<and> isEndpointCap capb then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))))) proof (prove)
goal (12 subgoals):
 1. \<And>capa capb cap_b cap_a x x1. \<lbrakk>ccap_relation (capability.ThreadCap x1) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ThreadCap x1) x; capa = capability.ThreadCap x1\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_thread_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ThreadCap v0 then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ThreadCap v0 then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_thread_cap \<longrightarrow> (cap_endpoint_cap = cap_thread_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ThreadCap v0 then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ThreadCap v0 then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_thread_cap \<longrightarrow> (cap_notification_cap = cap_thread_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ThreadCap v0 then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ThreadCap v0 then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_thread_cap \<longrightarrow> (cap_cnode_cap = cap_thread_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ThreadCap v0 then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ThreadCap v0 then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ThreadCap v0 then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_thread_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ThreadCap v0 then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ThreadCap v0 then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))
 2. \<And>capa capb cap_b cap_a. \<lbrakk>ccap_relation capability.NullCap cap_a; ccap_relation capb cap_b; capAligned capb; capa = capability.NullCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_null_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_null_cap \<longrightarrow> (cap_endpoint_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_null_cap \<longrightarrow> (cap_notification_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_null_cap \<longrightarrow> (cap_cnode_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_null_cap \<longrightarrow> (cap_thread_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_null_cap \<longrightarrow> (cap_reply_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_null_cap \<longrightarrow> (cap_domain_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<and> (cap_domain_cap \<noteq> cap_null_cap \<longrightarrow> (cap_irq_control_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_null_cap \<longrightarrow> (cap_irq_handler_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_null_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_null_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 3. \<And>capa capb cap_b cap_a x x31 x32 x33 x34. \<lbrakk>ccap_relation (capability.NotificationCap x31 x32 x33 x34) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.NotificationCap x31 x32 x33 x34) x; capa = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_notification_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_notification_cap \<longrightarrow> (cap_endpoint_cap = cap_notification_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_notification_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))
 4. \<And>capa capb cap_b cap_a x x4. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.IRQHandlerCap x4) x; capa = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_handler_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_notification_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_cnode_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_thread_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_reply_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_domain_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_irq_control_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_irq_control_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))))
 5. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_endpoint_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_endpoint_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))
 6. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.DomainCap x; capa = capability.DomainCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_domain_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_endpoint_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_notification_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_cnode_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_thread_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_reply_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))
 7. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 8. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 9. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 10. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
A total of 12 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>capa capb cap_b cap_a x x1 x1a. \<lbrakk>ccap_relation (capability.ThreadCap x1) cap_a; ccap_relation (capability.ThreadCap x1a) cap_b; capAligned (capability.ThreadCap x1a); valid_cap' (capability.ThreadCap x1) x; capa = capability.ThreadCap x1; capb = capability.ThreadCap x1a\<rbrakk> \<Longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (x1 = x1a)
 2. \<And>capa capb cap_b cap_a x x1 x8. \<lbrakk>ccap_relation (capability.ThreadCap x1) cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' (capability.ThreadCap x1) x; capa = capability.ThreadCap x1; capb = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 0xC \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false
 3. \<And>capa capb cap_b cap_a. \<lbrakk>ccap_relation capability.NullCap cap_a; ccap_relation capb cap_b; capAligned capb; capa = capability.NullCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_null_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_null_cap \<longrightarrow> (cap_endpoint_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_null_cap \<longrightarrow> (cap_notification_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_null_cap \<longrightarrow> (cap_cnode_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_null_cap \<longrightarrow> (cap_thread_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_null_cap \<longrightarrow> (cap_reply_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_null_cap \<longrightarrow> (cap_domain_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<and> (cap_domain_cap \<noteq> cap_null_cap \<longrightarrow> (cap_irq_control_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_null_cap \<longrightarrow> (cap_irq_handler_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_null_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_null_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 4. \<And>capa capb cap_b cap_a x x31 x32 x33 x34. \<lbrakk>ccap_relation (capability.NotificationCap x31 x32 x33 x34) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.NotificationCap x31 x32 x33 x34) x; capa = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_notification_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_notification_cap \<longrightarrow> (cap_endpoint_cap = cap_notification_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_notification_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))
 5. \<And>capa capb cap_b cap_a x x4. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.IRQHandlerCap x4) x; capa = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_handler_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_notification_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_cnode_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_thread_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_reply_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_domain_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_irq_control_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_irq_control_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))))
 6. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_endpoint_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_endpoint_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))
 7. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.DomainCap x; capa = capability.DomainCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_domain_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_endpoint_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_notification_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_cnode_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_thread_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_reply_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))
 8. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 9. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 10. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>capa capb cap_b cap_a x x1 x1a. \<lbrakk>ccap_relation (capability.ThreadCap x1) cap_a; ccap_relation (capability.ThreadCap x1a) cap_b; capAligned (capability.ThreadCap x1a); valid_cap' (capability.ThreadCap x1) x; capa = capability.ThreadCap x1; capb = capability.ThreadCap x1a; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrakk> \<Longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (x1 = x1a)
 2. \<And>capa capb cap_b cap_a x x1 x8. \<lbrakk>ccap_relation (capability.ThreadCap x1) cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' (capability.ThreadCap x1) x; capa = capability.ThreadCap x1; capb = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 0xC \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false
 3. \<And>capa capb cap_b cap_a. \<lbrakk>ccap_relation capability.NullCap cap_a; ccap_relation capb cap_b; capAligned capb; capa = capability.NullCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_null_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_null_cap \<longrightarrow> (cap_endpoint_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_null_cap \<longrightarrow> (cap_notification_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_null_cap \<longrightarrow> (cap_cnode_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_null_cap \<longrightarrow> (cap_thread_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_null_cap \<longrightarrow> (cap_reply_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_null_cap \<longrightarrow> (cap_domain_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<and> (cap_domain_cap \<noteq> cap_null_cap \<longrightarrow> (cap_irq_control_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_null_cap \<longrightarrow> (cap_irq_handler_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_null_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_null_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 4. \<And>capa capb cap_b cap_a x x31 x32 x33 x34. \<lbrakk>ccap_relation (capability.NotificationCap x31 x32 x33 x34) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.NotificationCap x31 x32 x33 x34) x; capa = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_notification_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_notification_cap \<longrightarrow> (cap_endpoint_cap = cap_notification_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_notification_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))
 5. \<And>capa capb cap_b cap_a x x4. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.IRQHandlerCap x4) x; capa = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_handler_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_notification_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_cnode_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_thread_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_reply_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_domain_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_irq_control_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_irq_control_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))))
 6. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_endpoint_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_endpoint_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))
 7. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.DomainCap x; capa = capability.DomainCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_domain_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_endpoint_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_notification_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_cnode_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_thread_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_reply_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))
 8. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 9. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 10. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>capa capb cap_b cap_a x x1 x1a. \<lbrakk>ccap_relation (capability.ThreadCap x1) cap_a; ccap_relation (capability.ThreadCap x1a) cap_b; capAligned (capability.ThreadCap x1a); valid_cap' (capability.ThreadCap x1) x; capa = capability.ThreadCap x1; capb = capability.ThreadCap x1a; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrakk> \<Longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (x1 = x1a)
 2. \<And>capa capb cap_b cap_a x x1 x8. \<lbrakk>ccap_relation (capability.ThreadCap x1) cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' (capability.ThreadCap x1) x; capa = capability.ThreadCap x1; capb = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 0xC \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false
 3. \<And>capa capb cap_b cap_a. \<lbrakk>ccap_relation capability.NullCap cap_a; ccap_relation capb cap_b; capAligned capb; capa = capability.NullCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_null_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_null_cap \<longrightarrow> (cap_endpoint_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_null_cap \<longrightarrow> (cap_notification_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_null_cap \<longrightarrow> (cap_cnode_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_null_cap \<longrightarrow> (cap_thread_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_null_cap \<longrightarrow> (cap_reply_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_null_cap \<longrightarrow> (cap_domain_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<and> (cap_domain_cap \<noteq> cap_null_cap \<longrightarrow> (cap_irq_control_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_null_cap \<longrightarrow> (cap_irq_handler_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_null_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_null_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 4. \<And>capa capb cap_b cap_a x x31 x32 x33 x34. \<lbrakk>ccap_relation (capability.NotificationCap x31 x32 x33 x34) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.NotificationCap x31 x32 x33 x34) x; capa = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_notification_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_notification_cap \<longrightarrow> (cap_endpoint_cap = cap_notification_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_notification_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))
 5. \<And>capa capb cap_b cap_a x x4. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.IRQHandlerCap x4) x; capa = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_handler_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_notification_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_cnode_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_thread_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_reply_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_domain_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_irq_control_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_irq_control_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))))
 6. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_endpoint_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_endpoint_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))
 7. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.DomainCap x; capa = capability.DomainCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_domain_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_endpoint_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_notification_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_cnode_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_thread_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_reply_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))
 8. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 9. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 10. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>capa capb cap_b cap_a x x1 x1a. \<lbrakk>Some (capability.ThreadCap x1) = (case cap_lift cap_a of None \<Rightarrow> None | Some x \<Rightarrow> Some (cap_to_H x)); Some (capability.ThreadCap x1a) = (case cap_lift cap_b of None \<Rightarrow> None | Some x \<Rightarrow> Some (cap_to_H x)); capAligned (capability.ThreadCap x1a); valid_cap' (capability.ThreadCap x1) x; capa = capability.ThreadCap x1; capb = capability.ThreadCap x1a; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrakk> \<Longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (x1 = x1a)
 2. \<And>capa capb cap_b cap_a x x1 x8. \<lbrakk>ccap_relation (capability.ThreadCap x1) cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' (capability.ThreadCap x1) x; capa = capability.ThreadCap x1; capb = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 0xC \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false
 3. \<And>capa capb cap_b cap_a. \<lbrakk>ccap_relation capability.NullCap cap_a; ccap_relation capb cap_b; capAligned capb; capa = capability.NullCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_null_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_null_cap \<longrightarrow> (cap_endpoint_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_null_cap \<longrightarrow> (cap_notification_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_null_cap \<longrightarrow> (cap_cnode_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_null_cap \<longrightarrow> (cap_thread_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_null_cap \<longrightarrow> (cap_reply_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_null_cap \<longrightarrow> (cap_domain_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<and> (cap_domain_cap \<noteq> cap_null_cap \<longrightarrow> (cap_irq_control_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_null_cap \<longrightarrow> (cap_irq_handler_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_null_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_null_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 4. \<And>capa capb cap_b cap_a x x31 x32 x33 x34. \<lbrakk>ccap_relation (capability.NotificationCap x31 x32 x33 x34) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.NotificationCap x31 x32 x33 x34) x; capa = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_notification_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_notification_cap \<longrightarrow> (cap_endpoint_cap = cap_notification_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_notification_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))
 5. \<And>capa capb cap_b cap_a x x4. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.IRQHandlerCap x4) x; capa = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_handler_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_notification_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_cnode_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_thread_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_reply_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_domain_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_irq_control_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_irq_control_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))))
 6. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_endpoint_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_endpoint_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))
 7. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.DomainCap x; capa = capability.DomainCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_domain_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_endpoint_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_notification_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_cnode_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_thread_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_reply_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))
 8. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 9. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 10. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>capa capb cap_b cap_a x x1 x1a. \<lbrakk>capability.ThreadCap x1 = cap_to_H (Cap_thread_cap (cap_thread_cap_lift cap_a)); capability.ThreadCap x1a = cap_to_H (Cap_thread_cap (cap_thread_cap_lift cap_b)); capAligned (cap_to_H (Cap_thread_cap (cap_thread_cap_lift cap_b))); valid_cap' (cap_to_H (Cap_thread_cap (cap_thread_cap_lift cap_a))) x; capa = cap_to_H (Cap_thread_cap (cap_thread_cap_lift cap_a)); capb = cap_to_H (Cap_thread_cap (cap_thread_cap_lift cap_b)); cap_lift cap_a = Some (Cap_thread_cap (cap_thread_cap_lift cap_a)); cap_lift cap_b = Some (Cap_thread_cap (cap_thread_cap_lift cap_b))\<rbrakk> \<Longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (x1 = x1a)
 2. \<And>capa capb cap_b cap_a x x1 x8. \<lbrakk>ccap_relation (capability.ThreadCap x1) cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' (capability.ThreadCap x1) x; capa = capability.ThreadCap x1; capb = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 0xC \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false
 3. \<And>capa capb cap_b cap_a. \<lbrakk>ccap_relation capability.NullCap cap_a; ccap_relation capb cap_b; capAligned capb; capa = capability.NullCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_null_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_null_cap \<longrightarrow> (cap_endpoint_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_null_cap \<longrightarrow> (cap_notification_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_null_cap \<longrightarrow> (cap_cnode_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_null_cap \<longrightarrow> (cap_thread_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_null_cap \<longrightarrow> (cap_reply_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_null_cap \<longrightarrow> (cap_domain_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<and> (cap_domain_cap \<noteq> cap_null_cap \<longrightarrow> (cap_irq_control_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_null_cap \<longrightarrow> (cap_irq_handler_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_null_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_null_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 4. \<And>capa capb cap_b cap_a x x31 x32 x33 x34. \<lbrakk>ccap_relation (capability.NotificationCap x31 x32 x33 x34) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.NotificationCap x31 x32 x33 x34) x; capa = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_notification_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_notification_cap \<longrightarrow> (cap_endpoint_cap = cap_notification_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_notification_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))
 5. \<And>capa capb cap_b cap_a x x4. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.IRQHandlerCap x4) x; capa = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_handler_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_notification_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_cnode_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_thread_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_reply_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_domain_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_irq_control_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_irq_control_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))))
 6. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_endpoint_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_endpoint_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))
 7. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.DomainCap x; capa = capability.DomainCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_domain_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_endpoint_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_notification_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_cnode_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_thread_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_reply_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))
 8. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 9. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 10. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>capa capb cap_b cap_a x x1 x1a. \<lbrakk>x1 = ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a))); x1a = ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b))); capAligned (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b))))); valid_cap' (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a))))) x; capa = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a)))); capb = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b)))); cap_lift cap_a = Some (Cap_thread_cap (cap_thread_cap_lift cap_a)); cap_lift cap_b = Some (Cap_thread_cap (cap_thread_cap_lift cap_b))\<rbrakk> \<Longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a))) = ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b))))
 2. \<And>capa capb cap_b cap_a x x1 x8. \<lbrakk>ccap_relation (capability.ThreadCap x1) cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' (capability.ThreadCap x1) x; capa = capability.ThreadCap x1; capb = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 0xC \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false
 3. \<And>capa capb cap_b cap_a. \<lbrakk>ccap_relation capability.NullCap cap_a; ccap_relation capb cap_b; capAligned capb; capa = capability.NullCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_null_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_null_cap \<longrightarrow> (cap_endpoint_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_null_cap \<longrightarrow> (cap_notification_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_null_cap \<longrightarrow> (cap_cnode_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_null_cap \<longrightarrow> (cap_thread_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_null_cap \<longrightarrow> (cap_reply_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_null_cap \<longrightarrow> (cap_domain_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<and> (cap_domain_cap \<noteq> cap_null_cap \<longrightarrow> (cap_irq_control_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_null_cap \<longrightarrow> (cap_irq_handler_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_null_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_null_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 4. \<And>capa capb cap_b cap_a x x31 x32 x33 x34. \<lbrakk>ccap_relation (capability.NotificationCap x31 x32 x33 x34) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.NotificationCap x31 x32 x33 x34) x; capa = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_notification_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_notification_cap \<longrightarrow> (cap_endpoint_cap = cap_notification_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_notification_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))
 5. \<And>capa capb cap_b cap_a x x4. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.IRQHandlerCap x4) x; capa = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_handler_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_notification_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_cnode_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_thread_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_reply_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_domain_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_irq_control_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_irq_control_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))))
 6. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_endpoint_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_endpoint_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))
 7. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.DomainCap x; capa = capability.DomainCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_domain_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_endpoint_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_notification_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_cnode_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_thread_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_reply_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))
 8. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 9. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 10. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>cap_b cap_a x. \<lbrakk>capAligned (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b))))); valid_cap' (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b))))) x; cap_lift cap_a = Some (Cap_thread_cap (cap_thread_cap_lift cap_a)); cap_lift cap_b = Some (Cap_thread_cap (cap_thread_cap_lift cap_b)); cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) \<noteq> cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b); ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a))) = ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b)))\<rbrakk> \<Longrightarrow> False
 2. \<And>capa capb cap_b cap_a x x1 x8. \<lbrakk>ccap_relation (capability.ThreadCap x1) cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' (capability.ThreadCap x1) x; capa = capability.ThreadCap x1; capb = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 0xC \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false
 3. \<And>capa capb cap_b cap_a. \<lbrakk>ccap_relation capability.NullCap cap_a; ccap_relation capb cap_b; capAligned capb; capa = capability.NullCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_null_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_null_cap \<longrightarrow> (cap_endpoint_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_null_cap \<longrightarrow> (cap_notification_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_null_cap \<longrightarrow> (cap_cnode_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_null_cap \<longrightarrow> (cap_thread_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_null_cap \<longrightarrow> (cap_reply_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_null_cap \<longrightarrow> (cap_domain_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<and> (cap_domain_cap \<noteq> cap_null_cap \<longrightarrow> (cap_irq_control_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_null_cap \<longrightarrow> (cap_irq_handler_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_null_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_null_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 4. \<And>capa capb cap_b cap_a x x31 x32 x33 x34. \<lbrakk>ccap_relation (capability.NotificationCap x31 x32 x33 x34) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.NotificationCap x31 x32 x33 x34) x; capa = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_notification_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_notification_cap \<longrightarrow> (cap_endpoint_cap = cap_notification_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_notification_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))
 5. \<And>capa capb cap_b cap_a x x4. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.IRQHandlerCap x4) x; capa = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_handler_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_notification_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_cnode_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_thread_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_reply_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_domain_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_irq_control_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_irq_control_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))))
 6. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_endpoint_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_endpoint_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))
 7. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.DomainCap x; capa = capability.DomainCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_domain_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_endpoint_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_notification_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_cnode_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_thread_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_reply_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))
 8. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 9. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 10. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>capa capb cap_b cap_a x x1 x8. \<lbrakk>ccap_relation (capability.ThreadCap x1) cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' (capability.ThreadCap x1) x; capa = capability.ThreadCap x1; capb = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 0xC \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false
 2. \<And>capa capb cap_b cap_a. \<lbrakk>ccap_relation capability.NullCap cap_a; ccap_relation capb cap_b; capAligned capb; capa = capability.NullCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_null_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_null_cap \<longrightarrow> (cap_endpoint_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_null_cap \<longrightarrow> (cap_notification_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_null_cap \<longrightarrow> (cap_cnode_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_null_cap \<longrightarrow> (cap_thread_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_null_cap \<longrightarrow> (cap_reply_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_null_cap \<longrightarrow> (cap_domain_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<and> (cap_domain_cap \<noteq> cap_null_cap \<longrightarrow> (cap_irq_control_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_null_cap \<longrightarrow> (cap_irq_handler_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_null_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_null_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 3. \<And>capa capb cap_b cap_a x x31 x32 x33 x34. \<lbrakk>ccap_relation (capability.NotificationCap x31 x32 x33 x34) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.NotificationCap x31 x32 x33 x34) x; capa = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_notification_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_notification_cap \<longrightarrow> (cap_endpoint_cap = cap_notification_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_notification_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))
 4. \<And>capa capb cap_b cap_a x x4. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.IRQHandlerCap x4) x; capa = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_handler_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_notification_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_cnode_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_thread_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_reply_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_domain_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_irq_control_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_irq_control_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))))
 5. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_endpoint_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_endpoint_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))
 6. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.DomainCap x; capa = capability.DomainCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_domain_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_endpoint_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_notification_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_cnode_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_thread_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_reply_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))
 7. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 8. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 9. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 10. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>capa capb cap_b cap_a x x1 x8. \<lbrakk>ccap_relation (capability.ThreadCap x1) cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' (capability.ThreadCap x1) x; capa = capability.ThreadCap x1; capb = capability.ArchObjectCap x8; isArchCap_tag (cap_get_tag cap_b)\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 0xC \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false
 2. \<And>capa capb cap_b cap_a. \<lbrakk>ccap_relation capability.NullCap cap_a; ccap_relation capb cap_b; capAligned capb; capa = capability.NullCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_null_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_null_cap \<longrightarrow> (cap_endpoint_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_null_cap \<longrightarrow> (cap_notification_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_null_cap \<longrightarrow> (cap_cnode_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_null_cap \<longrightarrow> (cap_thread_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_null_cap \<longrightarrow> (cap_reply_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_null_cap \<longrightarrow> (cap_domain_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<and> (cap_domain_cap \<noteq> cap_null_cap \<longrightarrow> (cap_irq_control_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_null_cap \<longrightarrow> (cap_irq_handler_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_null_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_null_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 3. \<And>capa capb cap_b cap_a x x31 x32 x33 x34. \<lbrakk>ccap_relation (capability.NotificationCap x31 x32 x33 x34) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.NotificationCap x31 x32 x33 x34) x; capa = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_notification_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_notification_cap \<longrightarrow> (cap_endpoint_cap = cap_notification_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_notification_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))
 4. \<And>capa capb cap_b cap_a x x4. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.IRQHandlerCap x4) x; capa = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_handler_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_notification_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_cnode_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_thread_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_reply_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_domain_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_irq_control_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_irq_control_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))))
 5. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_endpoint_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_endpoint_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))
 6. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.DomainCap x; capa = capability.DomainCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_domain_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_endpoint_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_notification_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_cnode_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_thread_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_reply_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))
 7. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 8. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 9. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 10. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>capa capb cap_b cap_a. \<lbrakk>ccap_relation capability.NullCap cap_a; ccap_relation capb cap_b; capAligned capb; capa = capability.NullCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_null_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_null_cap \<longrightarrow> (cap_endpoint_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_null_cap \<longrightarrow> (cap_notification_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_null_cap \<longrightarrow> (cap_cnode_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_null_cap \<longrightarrow> (cap_thread_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_null_cap \<longrightarrow> (cap_reply_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_null_cap \<longrightarrow> (cap_domain_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<and> (cap_domain_cap \<noteq> cap_null_cap \<longrightarrow> (cap_irq_control_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_null_cap \<longrightarrow> (cap_irq_handler_cap = cap_null_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_null_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_null_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 2. \<And>capa capb cap_b cap_a x x31 x32 x33 x34. \<lbrakk>ccap_relation (capability.NotificationCap x31 x32 x33 x34) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.NotificationCap x31 x32 x33 x34) x; capa = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_notification_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_notification_cap \<longrightarrow> (cap_endpoint_cap = cap_notification_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_notification_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))
 3. \<And>capa capb cap_b cap_a x x4. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.IRQHandlerCap x4) x; capa = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_handler_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_notification_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_cnode_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_thread_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_reply_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_domain_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_irq_control_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_irq_control_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))))
 4. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_endpoint_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_endpoint_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))
 5. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.DomainCap x; capa = capability.DomainCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_domain_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_endpoint_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_notification_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_cnode_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_thread_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_reply_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))
 6. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 7. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 8. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 9. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 10. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>capa capb cap_b cap_a x x31 x32 x33 x34. \<lbrakk>ccap_relation (capability.NotificationCap x31 x32 x33 x34) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.NotificationCap x31 x32 x33 x34) x; capa = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_notification_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_notification_cap \<longrightarrow> (cap_endpoint_cap = cap_notification_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_notification_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.NotificationCap v0 v1 v2 v3 then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))
 2. \<And>capa capb cap_b cap_a x x4. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.IRQHandlerCap x4) x; capa = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_handler_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_notification_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_cnode_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_thread_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_reply_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_domain_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_irq_control_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_irq_control_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))))
 3. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_endpoint_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_endpoint_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))
 4. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.DomainCap x; capa = capability.DomainCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_domain_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_endpoint_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_notification_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_cnode_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_thread_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_reply_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))
 5. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 6. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 7. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 8. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 9. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 10. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (11 subgoals):
 1. \<And>capa capb cap_b cap_a x x31 x32 x33 x34 x31a x32a x33a x34a. \<lbrakk>ccap_relation (capability.NotificationCap x31 x32 x33 x34) cap_a; ccap_relation (capability.NotificationCap x31a x32a x33a x34a) cap_b; capAligned (capability.NotificationCap x31a x32a x33a x34a); valid_cap' (capability.NotificationCap x31 x32 x33 x34) x; capa = capability.NotificationCap x31 x32 x33 x34; capb = capability.NotificationCap x31a x32a x33a x34a\<rbrakk> \<Longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (x31 = x31a)
 2. \<And>capa capb cap_b cap_a x x31 x32 x33 x34 x8. \<lbrakk>ccap_relation (capability.NotificationCap x31 x32 x33 x34) cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' (capability.NotificationCap x31 x32 x33 x34) x; capa = capability.NotificationCap x31 x32 x33 x34; capb = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 6 \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false
 3. \<And>capa capb cap_b cap_a x x4. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.IRQHandlerCap x4) x; capa = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_handler_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_notification_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_cnode_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_thread_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_reply_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_domain_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_irq_control_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_irq_control_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))))
 4. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_endpoint_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_endpoint_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))
 5. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.DomainCap x; capa = capability.DomainCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_domain_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_endpoint_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_notification_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_cnode_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_thread_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_reply_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))
 6. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 7. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 8. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 9. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 10. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>capa capb cap_b cap_a x x31 x32 x33 x34 x31a x32a x33a x34a. \<lbrakk>ccap_relation (capability.NotificationCap x31 x32 x33 x34) cap_a; ccap_relation (capability.NotificationCap x31a x32a x33a x34a) cap_b; capAligned (capability.NotificationCap x31a x32a x33a x34a); valid_cap' (capability.NotificationCap x31 x32 x33 x34) x; capa = capability.NotificationCap x31 x32 x33 x34; capb = capability.NotificationCap x31a x32a x33a x34a; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrakk> \<Longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (x31 = x31a)
 2. \<And>capa capb cap_b cap_a x x31 x32 x33 x34 x8. \<lbrakk>ccap_relation (capability.NotificationCap x31 x32 x33 x34) cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' (capability.NotificationCap x31 x32 x33 x34) x; capa = capability.NotificationCap x31 x32 x33 x34; capb = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 6 \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false
 3. \<And>capa capb cap_b cap_a x x4. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.IRQHandlerCap x4) x; capa = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_handler_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_notification_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_cnode_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_thread_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_reply_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_domain_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_irq_control_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_irq_control_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))))
 4. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_endpoint_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_endpoint_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))
 5. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.DomainCap x; capa = capability.DomainCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_domain_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_endpoint_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_notification_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_cnode_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_thread_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_reply_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))
 6. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 7. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 8. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 9. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 10. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>capa capb cap_b cap_a x x31 x32 x33 x34 x31a x32a x33a x34a. \<lbrakk>ccap_relation (capability.NotificationCap x31 x32 x33 x34) cap_a; ccap_relation (capability.NotificationCap x31a x32a x33a x34a) cap_b; capAligned (capability.NotificationCap x31a x32a x33a x34a); valid_cap' (capability.NotificationCap x31 x32 x33 x34) x; capa = capability.NotificationCap x31 x32 x33 x34; capb = capability.NotificationCap x31a x32a x33a x34a; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrakk> \<Longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (x31 = x31a)
 2. \<And>capa capb cap_b cap_a x x31 x32 x33 x34 x8. \<lbrakk>ccap_relation (capability.NotificationCap x31 x32 x33 x34) cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' (capability.NotificationCap x31 x32 x33 x34) x; capa = capability.NotificationCap x31 x32 x33 x34; capb = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 6 \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false
 3. \<And>capa capb cap_b cap_a x x4. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.IRQHandlerCap x4) x; capa = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_handler_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_notification_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_cnode_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_thread_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_reply_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_domain_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_irq_control_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_irq_control_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))))
 4. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_endpoint_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_endpoint_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))
 5. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.DomainCap x; capa = capability.DomainCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_domain_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_endpoint_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_notification_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_cnode_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_thread_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_reply_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))
 6. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 7. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 8. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 9. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 10. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>capa capb cap_b cap_a x x31 x32 x33 x34 x31a x32a x33a x34a. \<lbrakk>Some (capability.NotificationCap x31 x32 x33 x34) = (case cap_lift cap_a of None \<Rightarrow> None | Some x \<Rightarrow> Some (cap_to_H x)); Some (capability.NotificationCap x31a x32a x33a x34a) = (case cap_lift cap_b of None \<Rightarrow> None | Some x \<Rightarrow> Some (cap_to_H x)); capAligned (capability.NotificationCap x31a x32a x33a x34a); valid_cap' (capability.NotificationCap x31 x32 x33 x34) x; capa = capability.NotificationCap x31 x32 x33 x34; capb = capability.NotificationCap x31a x32a x33a x34a; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrakk> \<Longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (x31 = x31a)
 2. \<And>capa capb cap_b cap_a x x31 x32 x33 x34 x8. \<lbrakk>ccap_relation (capability.NotificationCap x31 x32 x33 x34) cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' (capability.NotificationCap x31 x32 x33 x34) x; capa = capability.NotificationCap x31 x32 x33 x34; capb = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 6 \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false
 3. \<And>capa capb cap_b cap_a x x4. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.IRQHandlerCap x4) x; capa = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_handler_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_notification_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_cnode_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_thread_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_reply_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_domain_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_irq_control_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_irq_control_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))))
 4. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_endpoint_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_endpoint_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))
 5. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.DomainCap x; capa = capability.DomainCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_domain_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_endpoint_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_notification_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_cnode_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_thread_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_reply_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))
 6. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 7. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 8. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 9. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 10. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>capa capb cap_b cap_a x x31 x32 x33 x34 x31a x32a x33a x34a. \<lbrakk>capability.NotificationCap x31 x32 x33 x34 = cap_to_H (Cap_notification_cap (cap_notification_cap_lift cap_a)); capability.NotificationCap x31a x32a x33a x34a = cap_to_H (Cap_notification_cap (cap_notification_cap_lift cap_b)); capAligned (cap_to_H (Cap_notification_cap (cap_notification_cap_lift cap_b))); valid_cap' (cap_to_H (Cap_notification_cap (cap_notification_cap_lift cap_a))) x; capa = cap_to_H (Cap_notification_cap (cap_notification_cap_lift cap_a)); capb = cap_to_H (Cap_notification_cap (cap_notification_cap_lift cap_b)); cap_lift cap_a = Some (Cap_notification_cap (cap_notification_cap_lift cap_a)); cap_lift cap_b = Some (Cap_notification_cap (cap_notification_cap_lift cap_b))\<rbrakk> \<Longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (x31 = x31a)
 2. \<And>capa capb cap_b cap_a x x31 x32 x33 x34 x8. \<lbrakk>ccap_relation (capability.NotificationCap x31 x32 x33 x34) cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' (capability.NotificationCap x31 x32 x33 x34) x; capa = capability.NotificationCap x31 x32 x33 x34; capb = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 6 \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false
 3. \<And>capa capb cap_b cap_a x x4. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.IRQHandlerCap x4) x; capa = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_handler_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_notification_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_cnode_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_thread_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_reply_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_domain_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_irq_control_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_irq_control_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))))
 4. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_endpoint_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_endpoint_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))
 5. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.DomainCap x; capa = capability.DomainCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_domain_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_endpoint_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_notification_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_cnode_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_thread_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_reply_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))
 6. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 7. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 8. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 9. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 10. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>capa capb cap_b cap_a x x31 x31a. \<lbrakk>x31 = capNtfnPtr_CL (cap_notification_cap_lift cap_a); x31a = capNtfnPtr_CL (cap_notification_cap_lift cap_b); capAligned (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift cap_b)) (capNtfnBadge_CL (cap_notification_cap_lift cap_b)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift cap_b))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift cap_b)))); valid_cap' (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift cap_a)) (capNtfnBadge_CL (cap_notification_cap_lift cap_a)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift cap_a))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift cap_a)))) x; capa = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift cap_a)) (capNtfnBadge_CL (cap_notification_cap_lift cap_a)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift cap_a))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift cap_a))); capb = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift cap_b)) (capNtfnBadge_CL (cap_notification_cap_lift cap_b)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift cap_b))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift cap_b))); cap_lift cap_a = Some (Cap_notification_cap (cap_notification_cap_lift cap_a)); cap_lift cap_b = Some (Cap_notification_cap (cap_notification_cap_lift cap_b))\<rbrakk> \<Longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b))
 2. \<And>capa capb cap_b cap_a x x31 x32 x33 x34 x8. \<lbrakk>ccap_relation (capability.NotificationCap x31 x32 x33 x34) cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' (capability.NotificationCap x31 x32 x33 x34) x; capa = capability.NotificationCap x31 x32 x33 x34; capb = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 6 \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false
 3. \<And>capa capb cap_b cap_a x x4. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.IRQHandlerCap x4) x; capa = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_handler_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_notification_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_cnode_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_thread_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_reply_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_domain_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_irq_control_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_irq_control_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))))
 4. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_endpoint_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_endpoint_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))
 5. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.DomainCap x; capa = capability.DomainCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_domain_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_endpoint_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_notification_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_cnode_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_thread_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_reply_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))
 6. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 7. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 8. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 9. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 10. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>capa capb cap_b cap_a x x31 x32 x33 x34 x8. \<lbrakk>ccap_relation (capability.NotificationCap x31 x32 x33 x34) cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' (capability.NotificationCap x31 x32 x33 x34) x; capa = capability.NotificationCap x31 x32 x33 x34; capb = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 6 \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false
 2. \<And>capa capb cap_b cap_a x x4. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.IRQHandlerCap x4) x; capa = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_handler_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_notification_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_cnode_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_thread_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_reply_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_domain_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_irq_control_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_irq_control_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))))
 3. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_endpoint_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_endpoint_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))
 4. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.DomainCap x; capa = capability.DomainCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_domain_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_endpoint_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_notification_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_cnode_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_thread_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_reply_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))
 5. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 6. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 7. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 8. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 9. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 10. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (10 subgoals):
 1. \<And>capa capb cap_b cap_a x x31 x32 x33 x34 x8. \<lbrakk>ccap_relation (capability.NotificationCap x31 x32 x33 x34) cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' (capability.NotificationCap x31 x32 x33 x34) x; capa = capability.NotificationCap x31 x32 x33 x34; capb = capability.ArchObjectCap x8; isArchCap_tag (cap_get_tag cap_b)\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 6 \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false
 2. \<And>capa capb cap_b cap_a x x4. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.IRQHandlerCap x4) x; capa = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_handler_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_notification_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_cnode_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_thread_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_reply_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_domain_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_irq_control_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_irq_control_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))))
 3. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_endpoint_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_endpoint_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))
 4. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.DomainCap x; capa = capability.DomainCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_domain_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_endpoint_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_notification_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_cnode_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_thread_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_reply_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))
 5. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 6. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 7. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 8. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 9. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 10. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (9 subgoals):
 1. \<And>capa capb cap_b cap_a x x4. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.IRQHandlerCap x4) x; capa = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_handler_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_notification_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_cnode_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_thread_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_reply_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_domain_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_irq_control_cap = cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_irq_control_cap \<noteq> cap_irq_handler_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.IRQHandlerCap v0 then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))))
 2. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_endpoint_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_endpoint_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))
 3. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.DomainCap x; capa = capability.DomainCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_domain_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_endpoint_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_notification_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_cnode_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_thread_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_reply_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))
 4. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 5. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 6. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 7. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 8. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 9. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (10 subgoals):
 1. \<And>capa capb cap_b cap_a x x4 x4a. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) cap_a; ccap_relation (capability.IRQHandlerCap x4a) cap_b; capAligned (capability.IRQHandlerCap x4a); valid_cap' (capability.IRQHandlerCap x4) x; capa = capability.IRQHandlerCap x4; capb = capability.IRQHandlerCap x4a\<rbrakk> \<Longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (x4 = x4a)
 2. \<And>capa capb cap_b cap_a x x4 x8. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' (capability.IRQHandlerCap x4) x; capa = capability.IRQHandlerCap x4; capb = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 0x1E \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false
 3. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_endpoint_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_endpoint_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))
 4. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.DomainCap x; capa = capability.DomainCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_domain_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_endpoint_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_notification_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_cnode_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_thread_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_reply_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))
 5. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 6. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 7. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 8. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 9. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 10. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (10 subgoals):
 1. \<And>capa capb cap_b cap_a x x4 x4a. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) cap_a; ccap_relation (capability.IRQHandlerCap x4a) cap_b; capAligned (capability.IRQHandlerCap x4a); valid_cap' (capability.IRQHandlerCap x4) x; capa = capability.IRQHandlerCap x4; capb = capability.IRQHandlerCap x4a; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap\<rbrakk> \<Longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (x4 = x4a)
 2. \<And>capa capb cap_b cap_a x x4 x8. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' (capability.IRQHandlerCap x4) x; capa = capability.IRQHandlerCap x4; capb = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 0x1E \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false
 3. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_endpoint_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_endpoint_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))
 4. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.DomainCap x; capa = capability.DomainCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_domain_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_endpoint_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_notification_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_cnode_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_thread_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_reply_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))
 5. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 6. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 7. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 8. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 9. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 10. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (10 subgoals):
 1. \<And>capa capb cap_b cap_a x x4 x4a. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) cap_a; ccap_relation (capability.IRQHandlerCap x4a) cap_b; capAligned (capability.IRQHandlerCap x4a); valid_cap' (capability.IRQHandlerCap x4) x; capa = capability.IRQHandlerCap x4; capb = capability.IRQHandlerCap x4a; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap; cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap\<rbrakk> \<Longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (x4 = x4a)
 2. \<And>capa capb cap_b cap_a x x4 x8. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' (capability.IRQHandlerCap x4) x; capa = capability.IRQHandlerCap x4; capb = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 0x1E \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false
 3. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_endpoint_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_endpoint_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))
 4. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.DomainCap x; capa = capability.DomainCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_domain_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_endpoint_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_notification_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_cnode_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_thread_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_reply_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))
 5. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 6. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 7. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 8. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 9. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 10. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (10 subgoals):
 1. \<And>capa capb cap_b cap_a x x4 x4a. \<lbrakk>Some (capability.IRQHandlerCap x4) = (case cap_lift cap_a of None \<Rightarrow> None | Some x \<Rightarrow> Some (cap_to_H x)) \<and> c_valid_cap cap_a; Some (capability.IRQHandlerCap x4a) = (case cap_lift cap_b of None \<Rightarrow> None | Some x \<Rightarrow> Some (cap_to_H x)) \<and> c_valid_cap cap_b; capAligned (capability.IRQHandlerCap x4a); valid_cap' (capability.IRQHandlerCap x4) x; capa = capability.IRQHandlerCap x4; capb = capability.IRQHandlerCap x4a; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap; cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap\<rbrakk> \<Longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (x4 = x4a)
 2. \<And>capa capb cap_b cap_a x x4 x8. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' (capability.IRQHandlerCap x4) x; capa = capability.IRQHandlerCap x4; capb = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 0x1E \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false
 3. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_endpoint_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_endpoint_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))
 4. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.DomainCap x; capa = capability.DomainCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_domain_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_endpoint_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_notification_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_cnode_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_thread_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_reply_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))
 5. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 6. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 7. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 8. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 9. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 10. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (10 subgoals):
 1. \<And>capa capb cap_b cap_a x x4 x4a. \<lbrakk>capability.IRQHandlerCap x4 = cap_to_H (Cap_irq_handler_cap (cap_irq_handler_cap_lift cap_a)) \<and> c_valid_cap cap_a; capability.IRQHandlerCap x4a = cap_to_H (Cap_irq_handler_cap (cap_irq_handler_cap_lift cap_b)) \<and> c_valid_cap cap_b; capAligned (cap_to_H (Cap_irq_handler_cap (cap_irq_handler_cap_lift cap_b))); valid_cap' (cap_to_H (Cap_irq_handler_cap (cap_irq_handler_cap_lift cap_a))) x; capa = cap_to_H (Cap_irq_handler_cap (cap_irq_handler_cap_lift cap_a)); capb = cap_to_H (Cap_irq_handler_cap (cap_irq_handler_cap_lift cap_b)); cap_lift cap_a = Some (Cap_irq_handler_cap (cap_irq_handler_cap_lift cap_a)); cap_lift cap_b = Some (Cap_irq_handler_cap (cap_irq_handler_cap_lift cap_b))\<rbrakk> \<Longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (x4 = x4a)
 2. \<And>capa capb cap_b cap_a x x4 x8. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' (capability.IRQHandlerCap x4) x; capa = capability.IRQHandlerCap x4; capb = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 0x1E \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false
 3. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_endpoint_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_endpoint_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))
 4. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.DomainCap x; capa = capability.DomainCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_domain_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_endpoint_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_notification_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_cnode_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_thread_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_reply_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))
 5. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 6. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 7. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 8. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 9. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 10. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (10 subgoals):
 1. \<And>capa capb cap_b cap_a x. \<lbrakk>c_valid_cap cap_a; c_valid_cap cap_b; capAligned (capability.IRQHandlerCap (UCAST(32 \<rightarrow> 10) (capIRQ_CL (cap_irq_handler_cap_lift cap_b)))); valid_cap' (capability.IRQHandlerCap (UCAST(32 \<rightarrow> 10) (capIRQ_CL (cap_irq_handler_cap_lift cap_a)))) x; capa = capability.IRQHandlerCap (UCAST(32 \<rightarrow> 10) (capIRQ_CL (cap_irq_handler_cap_lift cap_a))); capb = capability.IRQHandlerCap (UCAST(32 \<rightarrow> 10) (capIRQ_CL (cap_irq_handler_cap_lift cap_b))); cap_lift cap_a = Some (Cap_irq_handler_cap (cap_irq_handler_cap_lift cap_a)); cap_lift cap_b = Some (Cap_irq_handler_cap (cap_irq_handler_cap_lift cap_b))\<rbrakk> \<Longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (UCAST(32 \<rightarrow> 10) (capIRQ_CL (cap_irq_handler_cap_lift cap_a)) = UCAST(32 \<rightarrow> 10) (capIRQ_CL (cap_irq_handler_cap_lift cap_b)))
 2. \<And>capa capb cap_b cap_a x x4 x8. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' (capability.IRQHandlerCap x4) x; capa = capability.IRQHandlerCap x4; capb = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 0x1E \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false
 3. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_endpoint_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_endpoint_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))
 4. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.DomainCap x; capa = capability.DomainCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_domain_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_endpoint_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_notification_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_cnode_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_thread_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_reply_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))
 5. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 6. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 7. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 8. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 9. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 10. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (10 subgoals):
 1. \<And>cap_b cap_a x. \<lbrakk>capIRQ_CL (cap_irq_handler_cap_lift cap_a) && mask 10 = capIRQ_CL (cap_irq_handler_cap_lift cap_a); capIRQ_CL (cap_irq_handler_cap_lift cap_b) && mask 10 = capIRQ_CL (cap_irq_handler_cap_lift cap_b); capAligned (capability.IRQHandlerCap (UCAST(32 \<rightarrow> 10) (capIRQ_CL (cap_irq_handler_cap_lift cap_b)))); valid_cap' (capability.IRQHandlerCap (UCAST(32 \<rightarrow> 10) (capIRQ_CL (cap_irq_handler_cap_lift cap_b)))) x; cap_lift cap_a = Some (Cap_irq_handler_cap (cap_irq_handler_cap_lift cap_a)); cap_lift cap_b = Some (Cap_irq_handler_cap (cap_irq_handler_cap_lift cap_b)); capIRQ_CL (cap_irq_handler_cap_lift cap_a) \<noteq> capIRQ_CL (cap_irq_handler_cap_lift cap_b); UCAST(32 \<rightarrow> 10) (capIRQ_CL (cap_irq_handler_cap_lift cap_a)) = UCAST(32 \<rightarrow> 10) (capIRQ_CL (cap_irq_handler_cap_lift cap_b))\<rbrakk> \<Longrightarrow> False
 2. \<And>capa capb cap_b cap_a x x4 x8. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' (capability.IRQHandlerCap x4) x; capa = capability.IRQHandlerCap x4; capb = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 0x1E \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false
 3. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_endpoint_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_endpoint_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))
 4. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.DomainCap x; capa = capability.DomainCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_domain_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_endpoint_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_notification_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_cnode_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_thread_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_reply_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))
 5. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 6. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 7. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 8. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 9. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 10. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (10 subgoals):
 1. \<And>cap_b cap_a x. \<lbrakk>capIRQ_CL (cap_irq_handler_cap_lift cap_a) && mask 10 = capIRQ_CL (cap_irq_handler_cap_lift cap_a); capIRQ_CL (cap_irq_handler_cap_lift cap_b) && mask 10 = capIRQ_CL (cap_irq_handler_cap_lift cap_b); capAligned (capability.IRQHandlerCap (UCAST(32 \<rightarrow> 10) (capIRQ_CL (cap_irq_handler_cap_lift cap_b)))); valid_cap' (capability.IRQHandlerCap (UCAST(32 \<rightarrow> 10) (capIRQ_CL (cap_irq_handler_cap_lift cap_b)))) x; cap_lift cap_a = Some (Cap_irq_handler_cap (cap_irq_handler_cap_lift cap_a)); cap_lift cap_b = Some (Cap_irq_handler_cap (cap_irq_handler_cap_lift cap_b)); capIRQ_CL (cap_irq_handler_cap_lift cap_a) \<noteq> capIRQ_CL (cap_irq_handler_cap_lift cap_b); capIRQ_CL (cap_irq_handler_cap_lift cap_a) = UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) (capIRQ_CL (cap_irq_handler_cap_lift cap_b)))\<rbrakk> \<Longrightarrow> False
 2. \<And>capa capb cap_b cap_a x x4 x8. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' (capability.IRQHandlerCap x4) x; capa = capability.IRQHandlerCap x4; capb = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 0x1E \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false
 3. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_endpoint_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_endpoint_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))
 4. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.DomainCap x; capa = capability.DomainCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_domain_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_endpoint_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_notification_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_cnode_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_thread_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_reply_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))
 5. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 6. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 7. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 8. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 9. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 10. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (9 subgoals):
 1. \<And>capa capb cap_b cap_a x x4 x8. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' (capability.IRQHandlerCap x4) x; capa = capability.IRQHandlerCap x4; capb = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 0x1E \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false
 2. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_endpoint_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_endpoint_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))
 3. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.DomainCap x; capa = capability.DomainCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_domain_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_endpoint_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_notification_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_cnode_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_thread_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_reply_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))
 4. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 5. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 6. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 7. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 8. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 9. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (9 subgoals):
 1. \<And>capa capb cap_b cap_a x x4 x8. \<lbrakk>ccap_relation (capability.IRQHandlerCap x4) cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' (capability.IRQHandlerCap x4) x; capa = capability.IRQHandlerCap x4; capb = capability.ArchObjectCap x8; isArchCap_tag (cap_get_tag cap_b)\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 0x1E \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false
 2. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_endpoint_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_endpoint_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))
 3. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.DomainCap x; capa = capability.DomainCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_domain_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_endpoint_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_notification_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_cnode_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_thread_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_reply_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))
 4. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 5. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 6. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 7. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 8. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 9. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (8 subgoals):
 1. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_endpoint_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_endpoint_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3 v4 v5. capb = capability.EndpointCap v0 v1 v2 v3 v4 v5 then capEPPtr capa = capEPPtr capb else if isNotificationCap capa \<and> isNotificationCap capb then capNtfnPtr capa = capNtfnPtr capb else if isCNodeCap capa \<and> isCNodeCap capb then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))
 2. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.DomainCap x; capa = capability.DomainCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_domain_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_endpoint_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_notification_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_cnode_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_thread_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_reply_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))
 3. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 4. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 5. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 6. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 7. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 8. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (9 subgoals):
 1. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56 x51a x52a x53a x54a x55a x56a. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation (capability.EndpointCap x51a x52a x53a x54a x55a x56a) cap_b; capAligned (capability.EndpointCap x51a x52a x53a x54a x55a x56a); valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56; capb = capability.EndpointCap x51a x52a x53a x54a x55a x56a\<rbrakk> \<Longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (x51 = x51a)
 2. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56 x8. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56; capb = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 4 \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false
 3. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.DomainCap x; capa = capability.DomainCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_domain_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_endpoint_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_notification_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_cnode_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_thread_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_reply_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))
 4. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 5. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 6. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 7. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 8. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 9. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (9 subgoals):
 1. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56 x51a x52a x53a x54a x55a x56a. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation (capability.EndpointCap x51a x52a x53a x54a x55a x56a) cap_b; capAligned (capability.EndpointCap x51a x52a x53a x54a x55a x56a); valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56; capb = capability.EndpointCap x51a x52a x53a x54a x55a x56a; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrakk> \<Longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (x51 = x51a)
 2. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56 x8. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56; capb = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 4 \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false
 3. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.DomainCap x; capa = capability.DomainCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_domain_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_endpoint_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_notification_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_cnode_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_thread_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_reply_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))
 4. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 5. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 6. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 7. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 8. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 9. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (9 subgoals):
 1. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56 x51a x52a x53a x54a x55a x56a. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation (capability.EndpointCap x51a x52a x53a x54a x55a x56a) cap_b; capAligned (capability.EndpointCap x51a x52a x53a x54a x55a x56a); valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56; capb = capability.EndpointCap x51a x52a x53a x54a x55a x56a; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrakk> \<Longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (x51 = x51a)
 2. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56 x8. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56; capb = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 4 \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false
 3. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.DomainCap x; capa = capability.DomainCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_domain_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_endpoint_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_notification_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_cnode_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_thread_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_reply_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))
 4. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 5. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 6. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 7. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 8. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 9. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (9 subgoals):
 1. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56 x51a x52a x53a x54a x55a x56a. \<lbrakk>Some (capability.EndpointCap x51 x52 x53 x54 x55 x56) = (case cap_lift cap_a of None \<Rightarrow> None | Some x \<Rightarrow> Some (cap_to_H x)); Some (capability.EndpointCap x51a x52a x53a x54a x55a x56a) = (case cap_lift cap_b of None \<Rightarrow> None | Some x \<Rightarrow> Some (cap_to_H x)); capAligned (capability.EndpointCap x51a x52a x53a x54a x55a x56a); valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56; capb = capability.EndpointCap x51a x52a x53a x54a x55a x56a; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrakk> \<Longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (x51 = x51a)
 2. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56 x8. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56; capb = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 4 \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false
 3. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.DomainCap x; capa = capability.DomainCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_domain_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_endpoint_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_notification_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_cnode_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_thread_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_reply_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))
 4. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 5. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 6. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 7. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 8. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 9. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (9 subgoals):
 1. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56 x51a x52a x53a x54a x55a x56a. \<lbrakk>capability.EndpointCap x51 x52 x53 x54 x55 x56 = cap_to_H (Cap_endpoint_cap (cap_endpoint_cap_lift cap_a)); capability.EndpointCap x51a x52a x53a x54a x55a x56a = cap_to_H (Cap_endpoint_cap (cap_endpoint_cap_lift cap_b)); capAligned (cap_to_H (Cap_endpoint_cap (cap_endpoint_cap_lift cap_b))); valid_cap' (cap_to_H (Cap_endpoint_cap (cap_endpoint_cap_lift cap_a))) x; capa = cap_to_H (Cap_endpoint_cap (cap_endpoint_cap_lift cap_a)); capb = cap_to_H (Cap_endpoint_cap (cap_endpoint_cap_lift cap_b)); cap_lift cap_a = Some (Cap_endpoint_cap (cap_endpoint_cap_lift cap_a)); cap_lift cap_b = Some (Cap_endpoint_cap (cap_endpoint_cap_lift cap_b))\<rbrakk> \<Longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (x51 = x51a)
 2. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56 x8. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56; capb = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 4 \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false
 3. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.DomainCap x; capa = capability.DomainCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_domain_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_endpoint_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_notification_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_cnode_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_thread_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_reply_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))
 4. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 5. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 6. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 7. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 8. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 9. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (9 subgoals):
 1. \<And>capa capb cap_b cap_a x x51 x51a. \<lbrakk>x51 = capEPPtr_CL (cap_endpoint_cap_lift cap_a); x51a = capEPPtr_CL (cap_endpoint_cap_lift cap_b); capAligned (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift cap_b)) (capEPBadge_CL (cap_endpoint_cap_lift cap_b)) (to_bool (capCanSend_CL (cap_endpoint_cap_lift cap_b))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift cap_b))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift cap_b))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift cap_b)))); valid_cap' (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift cap_a)) (capEPBadge_CL (cap_endpoint_cap_lift cap_a)) (to_bool (capCanSend_CL (cap_endpoint_cap_lift cap_a))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift cap_a))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift cap_a))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift cap_a)))) x; capa = capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift cap_a)) (capEPBadge_CL (cap_endpoint_cap_lift cap_a)) (to_bool (capCanSend_CL (cap_endpoint_cap_lift cap_a))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift cap_a))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift cap_a))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift cap_a))); capb = capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift cap_b)) (capEPBadge_CL (cap_endpoint_cap_lift cap_b)) (to_bool (capCanSend_CL (cap_endpoint_cap_lift cap_b))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift cap_b))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift cap_b))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift cap_b))); cap_lift cap_a = Some (Cap_endpoint_cap (cap_endpoint_cap_lift cap_a)); cap_lift cap_b = Some (Cap_endpoint_cap (cap_endpoint_cap_lift cap_b))\<rbrakk> \<Longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b))
 2. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56 x8. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56; capb = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 4 \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false
 3. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.DomainCap x; capa = capability.DomainCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_domain_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_endpoint_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_notification_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_cnode_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_thread_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_reply_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))
 4. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 5. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 6. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 7. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 8. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 9. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (8 subgoals):
 1. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56 x8. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56; capb = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 4 \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false
 2. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.DomainCap x; capa = capability.DomainCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_domain_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_endpoint_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_notification_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_cnode_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_thread_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_reply_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))
 3. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 4. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 5. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 6. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 7. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 8. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (8 subgoals):
 1. \<And>capa capb cap_b cap_a x x51 x52 x53 x54 x55 x56 x8. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) x; capa = capability.EndpointCap x51 x52 x53 x54 x55 x56; capb = capability.ArchObjectCap x8; isArchCap_tag (cap_get_tag cap_b)\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 4 \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false
 2. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.DomainCap x; capa = capability.DomainCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_domain_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_endpoint_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_notification_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_cnode_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_thread_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_reply_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))
 3. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 4. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 5. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 6. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 7. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 8. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (7 subgoals):
 1. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.DomainCap x; capa = capability.DomainCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_domain_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_endpoint_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_notification_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_cnode_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_thread_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_reply_cap = cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_domain_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<longrightarrow> \<not> (if capb = capability.DomainCap then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))))))))
 2. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 3. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 4. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 5. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 6. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 7. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (7 subgoals):
 1. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' capability.DomainCap x; capa = capability.DomainCap; capb = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> cap_get_tag cap_b \<noteq> 0x3E
 2. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 3. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 4. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 5. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 6. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 7. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (7 subgoals):
 1. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation capability.DomainCap cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' capability.DomainCap x; capa = capability.DomainCap; capb = capability.ArchObjectCap x8; isArchCap_tag (cap_get_tag cap_b)\<rbrakk> \<Longrightarrow> cap_get_tag cap_b \<noteq> 0x3E
 2. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 3. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 4. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 5. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 6. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 7. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (6 subgoals):
 1. \<And>capa capb cap_b cap_a x x71 x72 x73. \<lbrakk>ccap_relation (capability.Zombie x71 x72 x73) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.Zombie x71 x72 x73) x; capa = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_zombie_cap \<longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_untyped_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_endpoint_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_endpoint_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_notification_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_notification_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_cnode_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_cnode_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_thread_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_thread_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_reply_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_reply_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_domain_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap) \<and> (cap_domain_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_control_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap)) \<and> (cap_irq_control_cap \<noteq> cap_zombie_cap \<longrightarrow> (cap_irq_handler_cap = cap_zombie_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false) \<and> (cap_irq_handler_cap \<noteq> cap_zombie_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap && 1 = 1 \<longrightarrow> cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> \<not> Arch.sameRegionAs capa capb)))))))))))
 2. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 3. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 4. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 5. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 6. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (5 subgoals):
 1. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 2. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 3. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 4. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 5. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (5 subgoals):
 1. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; capa = capability.ArchObjectCap x8; isArchCap_tag (cap_get_tag cap_a)\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap = cap_get_tag cap_a \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a && 1 = 1 \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capaa. ccap_relation (capability.ArchObjectCap capaa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capaa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 2. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 3. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 4. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 5. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (5 subgoals):
 1. \<And>capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; cap_get_tag cap_a && 1 = 1\<rbrakk> \<Longrightarrow> (cap_get_tag cap_a = 2 \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = 0x2E \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if \<not> ptr_val (get_capPtr_CL (cap_lift cap_b)) < capPtr_CL (cap_untyped_cap_lift cap_a) \<and> \<not> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) < ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<and> \<not> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) < ptr_val (get_capPtr_CL (cap_lift cap_b)) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case capability.ArchObjectCap x8 of capability.ArchObjectCap a \<Rightarrow> case capb of capability.ArchObjectCap x \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case capability.ArchObjectCap x8 of capability.ArchObjectCap a \<Rightarrow> case capb of capability.ArchObjectCap x \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a \<noteq> 2 \<longrightarrow> (cap_get_tag cap_a = 4 \<longrightarrow> (cap_get_tag cap_b = 4 \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case capability.ArchObjectCap x8 of capability.ArchObjectCap a \<Rightarrow> case capb of capability.ArchObjectCap x \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> 4 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case capability.ArchObjectCap x8 of capability.ArchObjectCap a \<Rightarrow> case capb of capability.ArchObjectCap x \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a \<noteq> 4 \<longrightarrow> (cap_get_tag cap_a = 6 \<longrightarrow> (cap_get_tag cap_b = 6 \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case capability.ArchObjectCap x8 of capability.ArchObjectCap a \<Rightarrow> case capb of capability.ArchObjectCap x \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> 6 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case capability.ArchObjectCap x8 of capability.ArchObjectCap a \<Rightarrow> case capb of capability.ArchObjectCap x \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a \<noteq> 6 \<longrightarrow> (cap_get_tag cap_a = 0xA \<longrightarrow> (cap_get_tag cap_b = 0xA \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case capability.ArchObjectCap x8 of capability.ArchObjectCap a \<Rightarrow> case capb of capability.ArchObjectCap x \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case capability.ArchObjectCap x8 of capability.ArchObjectCap a \<Rightarrow> case capb of capability.ArchObjectCap x \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> 0xA \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case capability.ArchObjectCap x8 of capability.ArchObjectCap a \<Rightarrow> case capb of capability.ArchObjectCap x \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a \<noteq> 0xA \<longrightarrow> (cap_get_tag cap_a = 0xC \<longrightarrow> (cap_get_tag cap_b = 0xC \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case capability.ArchObjectCap x8 of capability.ArchObjectCap a \<Rightarrow> case capb of capability.ArchObjectCap x \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> 0xC \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case capability.ArchObjectCap x8 of capability.ArchObjectCap a \<Rightarrow> case capb of capability.ArchObjectCap x \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a \<noteq> 0xC \<longrightarrow> (cap_get_tag cap_a = 8 \<longrightarrow> (cap_get_tag cap_b = 8 \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case capability.ArchObjectCap x8 of capability.ArchObjectCap a \<Rightarrow> case capb of capability.ArchObjectCap x \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> 8 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case capability.ArchObjectCap x8 of capability.ArchObjectCap a \<Rightarrow> case capb of capability.ArchObjectCap x \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a \<noteq> 8 \<longrightarrow> (cap_get_tag cap_a = 0x3E \<longrightarrow> (cap_get_tag cap_b = 0x3E \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case capability.ArchObjectCap x8 of capability.ArchObjectCap a \<Rightarrow> case capb of capability.ArchObjectCap x \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> 0x3E \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case capability.ArchObjectCap x8 of capability.ArchObjectCap a \<Rightarrow> case capb of capability.ArchObjectCap x \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a \<noteq> 0x3E \<longrightarrow> (cap_get_tag cap_a = 0xE \<longrightarrow> (cap_get_tag cap_b = 0xE \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case capability.ArchObjectCap x8 of capability.ArchObjectCap a \<Rightarrow> case capb of capability.ArchObjectCap x \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> 0xE \<longrightarrow> (cap_get_tag cap_b = 0x1E \<longrightarrow> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case capability.ArchObjectCap x8 of capability.ArchObjectCap a \<Rightarrow> case capb of capability.ArchObjectCap x \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> 0x1E \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case capability.ArchObjectCap x8 of capability.ArchObjectCap a \<Rightarrow> case capb of capability.ArchObjectCap x \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_a \<noteq> 0xE \<longrightarrow> (cap_get_tag cap_a = 0x1E \<longrightarrow> (cap_get_tag cap_b = 0x1E \<longrightarrow> (if capIRQ_CL (cap_irq_handler_cap_lift cap_a) = capIRQ_CL (cap_irq_handler_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0. capb = capability.ArchObjectCap v0 then case capability.ArchObjectCap x8 of capability.ArchObjectCap a \<Rightarrow> case capb of capability.ArchObjectCap x \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> 0x1E \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case capability.ArchObjectCap x8 of capability.ArchObjectCap a \<Rightarrow> case capb of capability.ArchObjectCap x \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_get_tag cap_a \<noteq> 0x1E \<longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case capability.ArchObjectCap x8 of capability.ArchObjectCap a \<Rightarrow> case capb of capability.ArchObjectCap x \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case capability.ArchObjectCap x8 of capability.ArchObjectCap a \<Rightarrow> case capb of capability.ArchObjectCap x \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))))
 2. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 3. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 4. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 5. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (5 subgoals):
 1. \<And>capb cap_b cap_a x x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ArchObjectCap x8) x; cap_get_tag cap_a && 1 = 1; cap_get_tag cap_a \<noteq> 2; cap_get_tag cap_a \<noteq> 4; cap_get_tag cap_a \<noteq> 6; cap_get_tag cap_a \<noteq> 0xA; cap_get_tag cap_a \<noteq> 0xC; cap_get_tag cap_a \<noteq> 8; cap_get_tag cap_a \<noteq> 0x3E; cap_get_tag cap_a \<noteq> 0xE; cap_get_tag cap_a \<noteq> 0x1E\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capba. ccap_relation (capability.ArchObjectCap capba) cap_b \<and> Arch.sameRegionAs capa capba = (if \<exists>v0. capb = capability.ArchObjectCap v0 then case capability.ArchObjectCap x8 of capability.ArchObjectCap a \<Rightarrow> case capb of capability.ArchObjectCap x \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> (if \<exists>v0. capb = capability.ArchObjectCap v0 then case capability.ArchObjectCap x8 of capability.ArchObjectCap a \<Rightarrow> case capb of capability.ArchObjectCap x \<Rightarrow> a `~Arch.sameRegionAs~` x else False))
 2. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 3. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 4. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 5. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (5 subgoals):
 1. \<And>capb cap_b cap_a x x8 x8a. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation (capability.ArchObjectCap x8a) cap_b; capAligned (capability.ArchObjectCap x8a); valid_cap' (capability.ArchObjectCap x8) x; cap_get_tag cap_a && 1 = 1; cap_get_tag cap_a \<noteq> 2; cap_get_tag cap_a \<noteq> 4; cap_get_tag cap_a \<noteq> 6; cap_get_tag cap_a \<noteq> 0xA; cap_get_tag cap_a \<noteq> 0xC; cap_get_tag cap_a \<noteq> 8; cap_get_tag cap_a \<noteq> 0x3E; cap_get_tag cap_a \<noteq> 0xE; cap_get_tag cap_a \<noteq> 0x1E; capb = capability.ArchObjectCap x8a\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> Arch.sameRegionAs capa capb = Arch.sameRegionAs x8 x8a))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> Arch.sameRegionAs x8 x8a)
 2. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 3. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 4. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 5. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (5 subgoals):
 1. \<And>capb cap_b cap_a x x8 x8a. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) cap_a; ccap_relation (capability.ArchObjectCap x8a) cap_b; capAligned (capability.ArchObjectCap x8a); valid_cap' (capability.ArchObjectCap x8) x; cap_get_tag cap_a && 1 = 1; cap_get_tag cap_a \<noteq> 2; cap_get_tag cap_a \<noteq> 4; cap_get_tag cap_a \<noteq> 6; cap_get_tag cap_a \<noteq> 0xA; cap_get_tag cap_a \<noteq> 0xC; cap_get_tag cap_a \<noteq> 8; cap_get_tag cap_a \<noteq> 0x3E; cap_get_tag cap_a \<noteq> 0xE; cap_get_tag cap_a \<noteq> 0x1E; capb = capability.ArchObjectCap x8a; isArchCap_tag (cap_get_tag cap_b)\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b && 1 = 1 \<longrightarrow> (\<exists>capa. ccap_relation (capability.ArchObjectCap capa) cap_a \<and> (\<exists>capb. ccap_relation (capability.ArchObjectCap capb) cap_b \<and> Arch.sameRegionAs capa capb = Arch.sameRegionAs x8 x8a))) \<and> (cap_get_tag cap_b && 1 = 0 \<longrightarrow> \<not> Arch.sameRegionAs x8 x8a)
 2. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 3. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 4. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 5. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (4 subgoals):
 1. \<And>capa capb cap_b cap_a x x91 x92 x93. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_reply_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_endpoint_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_notification_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_cnode_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_thread_cap = cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_reply_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2. capb = capability.ReplyCap v0 v1 v2 then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))
 2. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 3. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 4. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (5 subgoals):
 1. \<And>capa capb cap_b cap_a x x91 x92 x93 x8. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93; capb = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 8 \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false
 2. \<And>capa capb cap_b cap_a x x91 x92 x93 x91a x92a x93a. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation (capability.ReplyCap x91a x92a x93a) cap_b; capAligned (capability.ReplyCap x91a x92a x93a); valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93; capb = capability.ReplyCap x91a x92a x93a\<rbrakk> \<Longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (x91 = x91a)
 3. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 4. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 5. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (5 subgoals):
 1. \<And>capa capb cap_b cap_a x x91 x92 x93 x8. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93; capb = capability.ArchObjectCap x8; isArchCap_tag (cap_get_tag cap_b)\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 8 \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false
 2. \<And>capa capb cap_b cap_a x x91 x92 x93 x91a x92a x93a. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation (capability.ReplyCap x91a x92a x93a) cap_b; capAligned (capability.ReplyCap x91a x92a x93a); valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93; capb = capability.ReplyCap x91a x92a x93a\<rbrakk> \<Longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (x91 = x91a)
 3. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 4. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 5. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (4 subgoals):
 1. \<And>capa capb cap_b cap_a x x91 x92 x93 x91a x92a x93a. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation (capability.ReplyCap x91a x92a x93a) cap_b; capAligned (capability.ReplyCap x91a x92a x93a); valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93; capb = capability.ReplyCap x91a x92a x93a\<rbrakk> \<Longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (x91 = x91a)
 2. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 3. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 4. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (4 subgoals):
 1. \<And>capa capb cap_b cap_a x x91 x92 x93 x91a x92a x93a. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation (capability.ReplyCap x91a x92a x93a) cap_b; capAligned (capability.ReplyCap x91a x92a x93a); valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93; capb = capability.ReplyCap x91a x92a x93a; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrakk> \<Longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (x91 = x91a)
 2. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 3. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 4. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (4 subgoals):
 1. \<And>capa capb cap_b cap_a x x91 x92 x93 x91a x92a x93a. \<lbrakk>ccap_relation (capability.ReplyCap x91 x92 x93) cap_a; ccap_relation (capability.ReplyCap x91a x92a x93a) cap_b; capAligned (capability.ReplyCap x91a x92a x93a); valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93; capb = capability.ReplyCap x91a x92a x93a; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrakk> \<Longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (x91 = x91a)
 2. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 3. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 4. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (4 subgoals):
 1. \<And>capa capb cap_b cap_a x x91 x92 x93 x91a x92a x93a. \<lbrakk>Some (capability.ReplyCap x91 x92 x93) = (case cap_lift cap_a of None \<Rightarrow> None | Some x \<Rightarrow> Some (cap_to_H x)); Some (capability.ReplyCap x91a x92a x93a) = (case cap_lift cap_b of None \<Rightarrow> None | Some x \<Rightarrow> Some (cap_to_H x)); capAligned (capability.ReplyCap x91a x92a x93a); valid_cap' (capability.ReplyCap x91 x92 x93) x; capa = capability.ReplyCap x91 x92 x93; capb = capability.ReplyCap x91a x92a x93a; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrakk> \<Longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (x91 = x91a)
 2. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 3. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 4. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (4 subgoals):
 1. \<And>capa capb cap_b cap_a x x91 x92 x93 x91a x92a x93a. \<lbrakk>capability.ReplyCap x91 x92 x93 = cap_to_H (Cap_reply_cap (cap_reply_cap_lift cap_a)); capability.ReplyCap x91a x92a x93a = cap_to_H (Cap_reply_cap (cap_reply_cap_lift cap_b)); capAligned (cap_to_H (Cap_reply_cap (cap_reply_cap_lift cap_b))); valid_cap' (cap_to_H (Cap_reply_cap (cap_reply_cap_lift cap_a))) x; capa = cap_to_H (Cap_reply_cap (cap_reply_cap_lift cap_a)); capb = cap_to_H (Cap_reply_cap (cap_reply_cap_lift cap_b)); cap_lift cap_a = Some (Cap_reply_cap (cap_reply_cap_lift cap_a)); cap_lift cap_b = Some (Cap_reply_cap (cap_reply_cap_lift cap_b))\<rbrakk> \<Longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (x91 = x91a)
 2. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 3. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 4. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (4 subgoals):
 1. \<And>capa capb cap_b cap_a x x91 x91a. \<lbrakk>x91 = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) - ctcb_offset; x91a = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) - ctcb_offset; capAligned (capability.ReplyCap (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) - ctcb_offset) (to_bool (capReplyMaster_CL (cap_reply_cap_lift cap_b))) (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap_b)))); valid_cap' (capability.ReplyCap (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) - ctcb_offset) (to_bool (capReplyMaster_CL (cap_reply_cap_lift cap_a))) (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap_a)))) x; capa = capability.ReplyCap (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) - ctcb_offset) (to_bool (capReplyMaster_CL (cap_reply_cap_lift cap_a))) (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap_a))); capb = capability.ReplyCap (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) - ctcb_offset) (to_bool (capReplyMaster_CL (cap_reply_cap_lift cap_b))) (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap_b))); cap_lift cap_a = Some (Cap_reply_cap (cap_reply_cap_lift cap_a)); cap_lift cap_b = Some (Cap_reply_cap (cap_reply_cap_lift cap_b))\<rbrakk> \<Longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b))
 2. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 3. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 4. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (3 subgoals):
 1. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 2. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 3. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (3 subgoals):
 1. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB))
 2. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 3. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (4 subgoals):
 1. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)
 2. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)
 3. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 4. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (7 subgoals):
 1. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; get_capIsPhysical_CL (cap_lift cap_b)\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F
 2. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; get_capIsPhysical_CL (cap_lift cap_b)\<rbrakk> \<Longrightarrow> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20
 3. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; get_capIsPhysical_CL (cap_lift cap_b)\<rbrakk> \<Longrightarrow> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20
 4. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; get_capIsPhysical_CL (cap_lift cap_b)\<rbrakk> \<Longrightarrow> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)
 5. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)
 6. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 7. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (7 subgoals):
 1. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; get_capIsPhysical_CL (cap_lift cap_b); cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; capb = (if isZombieTCB_C (capZombieType_CL (cap_zombie_cap_lift cap_b)) then capability.Zombie (capZombieID_CL (cap_zombie_cap_lift cap_b) && ~~ mask 5) ZombieTCB (unat (capZombieID_CL (cap_zombie_cap_lift cap_b) && mask 5)) else let radix = unat (capZombieType_CL (cap_zombie_cap_lift cap_b)) in capability.Zombie (capZombieID_CL (cap_zombie_cap_lift cap_b) && ~~ mask (radix + 1)) (ZombieCNode radix) (unat (capZombieID_CL (cap_zombie_cap_lift cap_b) && mask (radix + 1))))\<rbrakk> \<Longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F
 2. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; get_capIsPhysical_CL (cap_lift cap_b)\<rbrakk> \<Longrightarrow> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20
 3. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; get_capIsPhysical_CL (cap_lift cap_b)\<rbrakk> \<Longrightarrow> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20
 4. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; get_capIsPhysical_CL (cap_lift cap_b)\<rbrakk> \<Longrightarrow> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)
 5. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)
 6. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 7. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (6 subgoals):
 1. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; get_capIsPhysical_CL (cap_lift cap_b)\<rbrakk> \<Longrightarrow> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20
 2. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; get_capIsPhysical_CL (cap_lift cap_b)\<rbrakk> \<Longrightarrow> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20
 3. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; get_capIsPhysical_CL (cap_lift cap_b)\<rbrakk> \<Longrightarrow> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)
 4. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)
 5. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 6. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (7 subgoals):
 1. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; get_capIsPhysical_CL (cap_lift cap_b); capBlockSize_CL (cap_untyped_cap_lift cap_a) \<le> 0x1F\<rbrakk> \<Longrightarrow> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20
 2. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; get_capIsPhysical_CL (cap_lift cap_b)\<rbrakk> \<Longrightarrow> capBlockSize_CL (cap_untyped_cap_lift cap_a) \<le> 0x1F
 3. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; get_capIsPhysical_CL (cap_lift cap_b)\<rbrakk> \<Longrightarrow> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20
 4. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; get_capIsPhysical_CL (cap_lift cap_b)\<rbrakk> \<Longrightarrow> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)
 5. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)
 6. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 7. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (6 subgoals):
 1. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; get_capIsPhysical_CL (cap_lift cap_b)\<rbrakk> \<Longrightarrow> capBlockSize_CL (cap_untyped_cap_lift cap_a) \<le> 0x1F
 2. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; get_capIsPhysical_CL (cap_lift cap_b)\<rbrakk> \<Longrightarrow> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20
 3. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; get_capIsPhysical_CL (cap_lift cap_b)\<rbrakk> \<Longrightarrow> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)
 4. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)
 5. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 6. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (5 subgoals):
 1. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; get_capIsPhysical_CL (cap_lift cap_b)\<rbrakk> \<Longrightarrow> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20
 2. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; get_capIsPhysical_CL (cap_lift cap_b)\<rbrakk> \<Longrightarrow> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)
 3. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)
 4. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 5. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (4 subgoals):
 1. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; get_capIsPhysical_CL (cap_lift cap_b)\<rbrakk> \<Longrightarrow> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)
 2. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)
 3. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 4. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (4 subgoals):
 1. \<And>capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; get_capIsPhysical_CL (cap_lift cap_b)\<rbrakk> \<Longrightarrow> (capClass capb = PhysicalClass \<and> x102 \<le> global.capUntypedPtr capb \<and> global.capUntypedPtr capb + global.capUntypedSize capb - 1 \<le> x102 + 2 ^ x103 - 1 \<and> global.capUntypedPtr capb \<le> global.capUntypedPtr capb + global.capUntypedSize capb - 1 \<longrightarrow> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1)) \<and> ((global.capUntypedPtr capb + global.capUntypedSize capb - 1 \<le> x102 + 2 ^ x103 - 1 \<longrightarrow> x102 \<le> global.capUntypedPtr capb \<longrightarrow> capClass capb = PhysicalClass \<longrightarrow> \<not> global.capUntypedPtr capb \<le> global.capUntypedPtr capb + global.capUntypedSize capb - 1) \<longrightarrow> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<longrightarrow> capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<longrightarrow> \<not> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1))
 2. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)
 3. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 4. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (4 subgoals):
 1. \<And>capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; get_capIsPhysical_CL (cap_lift cap_b)\<rbrakk> \<Longrightarrow> (capClass capb = PhysicalClass \<and> x102 \<le> global.capUntypedPtr capb \<and> global.capUntypedPtr capb + global.capUntypedSize capb - 1 \<le> x102 + 2 ^ x103 - 1 \<and> global.capUntypedPtr capb \<le> global.capUntypedPtr capb + global.capUntypedSize capb - 1 \<longrightarrow> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ get_capSizeBits_CL (cap_lift cap_b) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ get_capSizeBits_CL (cap_lift cap_b) - 1)) \<and> ((global.capUntypedPtr capb + global.capUntypedSize capb - 1 \<le> x102 + 2 ^ x103 - 1 \<longrightarrow> x102 \<le> global.capUntypedPtr capb \<longrightarrow> capClass capb = PhysicalClass \<longrightarrow> \<not> global.capUntypedPtr capb \<le> global.capUntypedPtr capb + global.capUntypedSize capb - 1) \<longrightarrow> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ get_capSizeBits_CL (cap_lift cap_b) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<longrightarrow> capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<longrightarrow> \<not> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ get_capSizeBits_CL (cap_lift cap_b) - 1))
 2. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)
 3. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 4. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (4 subgoals):
 1. \<And>capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; capClass capb = PhysicalClass\<rbrakk> \<Longrightarrow> (x102 \<le> global.capUntypedPtr capb \<and> global.capUntypedPtr capb + global.capUntypedSize capb - 1 \<le> x102 + 2 ^ x103 - 1 \<and> global.capUntypedPtr capb \<le> global.capUntypedPtr capb + global.capUntypedSize capb - 1 \<longrightarrow> global.capUntypedPtr capb + (global.capUntypedSize capb - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> capPtr_CL (cap_untyped_cap_lift cap_a) \<le> global.capUntypedPtr capb \<and> global.capUntypedPtr capb \<le> global.capUntypedPtr capb + (global.capUntypedSize capb - 1)) \<and> ((global.capUntypedPtr capb + global.capUntypedSize capb - 1 \<le> x102 + 2 ^ x103 - 1 \<longrightarrow> x102 \<le> global.capUntypedPtr capb \<longrightarrow> \<not> global.capUntypedPtr capb \<le> global.capUntypedPtr capb + global.capUntypedSize capb - 1) \<longrightarrow> global.capUntypedPtr capb + (global.capUntypedSize capb - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<longrightarrow> capPtr_CL (cap_untyped_cap_lift cap_a) \<le> global.capUntypedPtr capb \<longrightarrow> \<not> global.capUntypedPtr capb \<le> global.capUntypedPtr capb + (global.capUntypedSize capb - 1))
 2. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)
 3. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 4. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (7 subgoals):
 1. \<And>capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; capClass capb = PhysicalClass; x102 \<le> global.capUntypedPtr capb \<and> global.capUntypedPtr capb + global.capUntypedSize capb - 1 \<le> x102 + 2 ^ x103 - 1 \<and> global.capUntypedPtr capb \<le> global.capUntypedPtr capb + global.capUntypedSize capb - 1\<rbrakk> \<Longrightarrow> global.capUntypedPtr capb + (global.capUntypedSize capb - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1)
 2. \<And>capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; capClass capb = PhysicalClass; x102 \<le> global.capUntypedPtr capb \<and> global.capUntypedPtr capb + global.capUntypedSize capb - 1 \<le> x102 + 2 ^ x103 - 1 \<and> global.capUntypedPtr capb \<le> global.capUntypedPtr capb + global.capUntypedSize capb - 1\<rbrakk> \<Longrightarrow> capPtr_CL (cap_untyped_cap_lift cap_a) \<le> global.capUntypedPtr capb
 3. \<And>capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; capClass capb = PhysicalClass; x102 \<le> global.capUntypedPtr capb \<and> global.capUntypedPtr capb + global.capUntypedSize capb - 1 \<le> x102 + 2 ^ x103 - 1 \<and> global.capUntypedPtr capb \<le> global.capUntypedPtr capb + global.capUntypedSize capb - 1\<rbrakk> \<Longrightarrow> global.capUntypedPtr capb \<le> global.capUntypedPtr capb + (global.capUntypedSize capb - 1)
 4. \<And>capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; capClass capb = PhysicalClass; global.capUntypedPtr capb + global.capUntypedSize capb - 1 \<le> x102 + 2 ^ x103 - 1 \<longrightarrow> x102 \<le> global.capUntypedPtr capb \<longrightarrow> \<not> global.capUntypedPtr capb \<le> global.capUntypedPtr capb + global.capUntypedSize capb - 1; global.capUntypedPtr capb + (global.capUntypedSize capb - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1); capPtr_CL (cap_untyped_cap_lift cap_a) \<le> global.capUntypedPtr capb\<rbrakk> \<Longrightarrow> \<not> global.capUntypedPtr capb \<le> global.capUntypedPtr capb + (global.capUntypedSize capb - 1)
 5. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)
 6. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 7. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (3 subgoals):
 1. \<And>capa capb cap_b cap_a x x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.UntypedCap x101 x102 x103 x104) x; capa = capability.UntypedCap x101 x102 x103 x104; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (let baseB = global.capUntypedPtr capb; topB = baseB + global.capUntypedSize capb - 1 in capClass capb = PhysicalClass \<and> x102 \<le> baseB \<and> topB \<le> x102 + 2 ^ x103 - 1 \<and> baseB \<le> topB)
 2. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 3. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (2 subgoals):
 1. \<And>capa capb cap_b cap_a x x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_cnode_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_endpoint_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_notification_cap = cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_cnode_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> \<not> (if \<exists>v0 v1 v2 v3. capb = capability.CNodeCap v0 v1 v2 v3 then capCNodePtr capa = capCNodePtr capb \<and> capCNodeBits capa = capCNodeBits capb else if isThreadCap capa \<and> isThreadCap capb then capTCBPtr capa = capTCBPtr capb else if isReplyCap capa \<and> isReplyCap capb then capTCBPtr capa = capTCBPtr capb else if isDomainCap capa \<and> isDomainCap capb then True else if isIRQControlCap capa \<and> isIRQControlCap capb then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))
 2. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (3 subgoals):
 1. \<And>capa capb cap_b cap_a x x111 x112 x113 x114 x8. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114; capb = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 0xA \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false
 2. \<And>capa capb cap_b cap_a x x111 x112 x113 x114 x111a x112a x113a x114a. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation (capability.CNodeCap x111a x112a x113a x114a) cap_b; capAligned (capability.CNodeCap x111a x112a x113a x114a); valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114; capb = capability.CNodeCap x111a x112a x113a x114a\<rbrakk> \<Longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (x111 = x111a \<and> x112 = x112a)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (x111 = x111a \<and> x112 = x112a) = 0)
 3. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (3 subgoals):
 1. \<And>capa capb cap_b cap_a x x111 x112 x113 x114 x8. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114; capb = capability.ArchObjectCap x8; isArchCap_tag (cap_get_tag cap_b)\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 0xA \<longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = SCAST(32 signed \<rightarrow> 32) false
 2. \<And>capa capb cap_b cap_a x x111 x112 x113 x114 x111a x112a x113a x114a. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation (capability.CNodeCap x111a x112a x113a x114a) cap_b; capAligned (capability.CNodeCap x111a x112a x113a x114a); valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114; capb = capability.CNodeCap x111a x112a x113a x114a\<rbrakk> \<Longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (x111 = x111a \<and> x112 = x112a)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (x111 = x111a \<and> x112 = x112a) = 0)
 3. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (2 subgoals):
 1. \<And>capa capb cap_b cap_a x x111 x112 x113 x114 x111a x112a x113a x114a. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation (capability.CNodeCap x111a x112a x113a x114a) cap_b; capAligned (capability.CNodeCap x111a x112a x113a x114a); valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114; capb = capability.CNodeCap x111a x112a x113a x114a\<rbrakk> \<Longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (x111 = x111a \<and> x112 = x112a)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (x111 = x111a \<and> x112 = x112a) = 0)
 2. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (2 subgoals):
 1. \<And>capa capb cap_b cap_a x x111 x112 x113 x114 x111a x112a x113a x114a. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation (capability.CNodeCap x111a x112a x113a x114a) cap_b; capAligned (capability.CNodeCap x111a x112a x113a x114a); valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114; capb = capability.CNodeCap x111a x112a x113a x114a; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (x111 = x111a \<and> x112 = x112a)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (x111 = x111a \<and> x112 = x112a) = 0)
 2. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (2 subgoals):
 1. \<And>capa capb cap_b cap_a x x111 x112 x113 x114 x111a x112a x113a x114a. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap_a; ccap_relation (capability.CNodeCap x111a x112a x113a x114a) cap_b; capAligned (capability.CNodeCap x111a x112a x113a x114a); valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114; capb = capability.CNodeCap x111a x112a x113a x114a; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap; cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (x111 = x111a \<and> x112 = x112a)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (x111 = x111a \<and> x112 = x112a) = 0)
 2. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (2 subgoals):
 1. \<And>capa capb cap_b cap_a x x111 x112 x113 x114 x111a x112a x113a x114a. \<lbrakk>Some (capability.CNodeCap x111 x112 x113 x114) = (case cap_lift cap_a of None \<Rightarrow> None | Some x \<Rightarrow> Some (cap_to_H x)); Some (capability.CNodeCap x111a x112a x113a x114a) = (case cap_lift cap_b of None \<Rightarrow> None | Some x \<Rightarrow> Some (cap_to_H x)); capAligned (capability.CNodeCap x111a x112a x113a x114a); valid_cap' (capability.CNodeCap x111 x112 x113 x114) x; capa = capability.CNodeCap x111 x112 x113 x114; capb = capability.CNodeCap x111a x112a x113a x114a; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap; cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (x111 = x111a \<and> x112 = x112a)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (x111 = x111a \<and> x112 = x112a) = 0)
 2. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (2 subgoals):
 1. \<And>capa capb cap_b cap_a x x111 x112 x113 x114 x111a x112a x113a x114a. \<lbrakk>capability.CNodeCap x111 x112 x113 x114 = cap_to_H (Cap_cnode_cap (cap_cnode_cap_lift cap_a)); capability.CNodeCap x111a x112a x113a x114a = cap_to_H (Cap_cnode_cap (cap_cnode_cap_lift cap_b)); capAligned (cap_to_H (Cap_cnode_cap (cap_cnode_cap_lift cap_b))); valid_cap' (cap_to_H (Cap_cnode_cap (cap_cnode_cap_lift cap_a))) x; capa = cap_to_H (Cap_cnode_cap (cap_cnode_cap_lift cap_a)); capb = cap_to_H (Cap_cnode_cap (cap_cnode_cap_lift cap_b)); cap_lift cap_a = Some (Cap_cnode_cap (cap_cnode_cap_lift cap_a)); cap_lift cap_b = Some (Cap_cnode_cap (cap_cnode_cap_lift cap_b))\<rbrakk> \<Longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (x111 = x111a \<and> x112 = x112a)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (x111 = x111a \<and> x112 = x112a) = 0)
 2. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (2 subgoals):
 1. \<And>capa capb cap_b cap_a x x111 x111a. \<lbrakk>x111 = capCNodePtr_CL (cap_cnode_cap_lift cap_a); x111a = capCNodePtr_CL (cap_cnode_cap_lift cap_b); capAligned (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift cap_b)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift cap_b))) (capCNodeGuard_CL (cap_cnode_cap_lift cap_b)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift cap_b)))); valid_cap' (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift cap_a)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift cap_a))) (capCNodeGuard_CL (cap_cnode_cap_lift cap_a)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift cap_a)))) x; capa = capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift cap_a)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift cap_a))) (capCNodeGuard_CL (cap_cnode_cap_lift cap_a)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift cap_a))); capb = capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift cap_b)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift cap_b))) (capCNodeGuard_CL (cap_cnode_cap_lift cap_b)) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift cap_b))); cap_lift cap_a = Some (Cap_cnode_cap (cap_cnode_cap_lift cap_a)); cap_lift cap_b = Some (Cap_cnode_cap (cap_cnode_cap_lift cap_b))\<rbrakk> \<Longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b))
 2. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (1 subgoal):
 1. \<And>capa capb cap_b cap_a x. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation capb cap_b; capAligned capb; valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap\<rbrakk> \<Longrightarrow> (cap_untyped_cap = cap_irq_control_cap \<longrightarrow> (get_capIsPhysical_CL (cap_lift cap_b) \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> get_capZombieBits_CL (cap_zombie_cap_lift cap_b) < 0x1F) \<and> capBlockSize_CL (cap_untyped_cap_lift cap_a) < 0x20 \<and> word_of_nat (get_capSizeBits_CL (cap_lift cap_b)) < 0x20 \<and> (if capPtr_CL (cap_untyped_cap_lift cap_a) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) \<le> capPtr_CL (cap_untyped_cap_lift cap_a) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift cap_a)) - 1) \<and> ptr_val (get_capPtr_CL (cap_lift cap_b)) \<le> ptr_val (get_capPtr_CL (cap_lift cap_b)) + (2 ^ unat (word_of_nat (get_capSizeBits_CL (cap_lift cap_b))) - 1) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (from_bool (get_capIsPhysical_CL (cap_lift cap_b)) = 0 \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_untyped_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_endpoint_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capEPPtr_CL (cap_endpoint_cap_lift cap_a) = capEPPtr_CL (cap_endpoint_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_endpoint_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_notification_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capNtfnPtr_CL (cap_notification_cap_lift cap_a) = capNtfnPtr_CL (cap_notification_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_notification_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_cnode_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) = capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> (if capCNodeRadix_CL (cap_cnode_cap_lift cap_a) = capCNodeRadix_CL (cap_cnode_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (capCNodePtr_CL (cap_cnode_cap_lift cap_a) \<noteq> capCNodePtr_CL (cap_cnode_cap_lift cap_b) \<longrightarrow> from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False) = 0)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_cnode_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_thread_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_a) = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_thread_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_reply_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_a) = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap_b) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = from_bool (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_reply_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_domain_cap = cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False))) \<and> (cap_domain_cap \<noteq> cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> \<not> (if capb = capability.IRQControlCap then True else if isIRQControlCap capa \<and> isIRQHandlerCap capb then True else if isIRQHandlerCap capa \<and> isIRQHandlerCap capb then case (capa, capb) of (capability.IRQHandlerCap a, capability.IRQHandlerCap x) \<Rightarrow> a = x else if isArchObjectCap capa \<and> isArchObjectCap capb then case (capa, capb) of (capability.ArchObjectCap a, capability.ArchObjectCap x) \<Rightarrow> a `~Arch.sameRegionAs~` x else False)))))))))) proof (prove)
goal (1 subgoal):
 1. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap; capb = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> cap_get_tag cap_b \<noteq> 0xE \<and> (cap_get_tag cap_b \<noteq> 0xE \<longrightarrow> cap_get_tag cap_b \<noteq> 0x1E) proof (prove)
goal (1 subgoal):
 1. \<And>capa capb cap_b cap_a x x8. \<lbrakk>ccap_relation capability.IRQControlCap cap_a; ccap_relation (capability.ArchObjectCap x8) cap_b; capAligned (capability.ArchObjectCap x8); valid_cap' capability.IRQControlCap x; capa = capability.IRQControlCap; capb = capability.ArchObjectCap x8; isArchCap_tag (cap_get_tag cap_b)\<rbrakk> \<Longrightarrow> cap_get_tag cap_b \<noteq> 0xE \<and> (cap_get_tag cap_b \<noteq> 0xE \<longrightarrow> cap_get_tag cap_b \<noteq> 0x1E) proof (prove)
goal:
No subgoals!