theory CNodeInv_R

lemma cteMove_valid_mdb_helper:
  "(isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow>valid_mdb_ctes m'" proof note sameRegion_cap'_src [simp del] note dest_0 [simp del] src_0 [simp del] note src_next [simp del] note rtrancl0 [simp del] show "valid_dlist m'" by (rule dlist') show "no_0 m'" by (rule no_0') have chain: "mdb_chain_0 m" .. have mp: "cte_mdb_prop m dest (\<lambda>m. mdbPrev m = nullPointer \<and> mdbNext m = nullPointer)" using dest prev nxt unfolding cte_mdb_prop_def by (simp add: nullPointer_def) hence nsd: "\<not> m \<turnstile> mdbNext src_node \<leadsto>\<^sup>* dest" using dlist by (auto elim: next_rtrancl_tranclE dest: null_mdb_no_trancl [OF _ no_0]) have sd: "mdbNext src_node \<noteq> 0 \<Longrightarrow> mdbNext src_node \<in> dom m" proof - assume T: "mdbNext src_node \<noteq> 0" have "m \<turnstile> src \<leadsto> mdbNext src_node" by (rule m_p_next) moreover have "m \<turnstile> src \<leadsto>\<^sup>+ 0" using chain src unfolding mdb_chain_0_def by (clarsimp simp: dom_def) ultimately have "m \<turnstile> mdbNext src_node \<leadsto>\<^sup>+ 0" using T by (auto elim: tranclE2' simp: next_unfold') thus "mdbNext src_node \<in> dom m" by - (erule tranclE2', (clarsimp simp: next_unfold')+) qed let ?m = "(modify_map
       (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (%_. dest)))) src
         (cteMDBNode_update (mdbNext_update (%_. (mdbNext nullMDBNode)))))
       dest (cteMDBNode_update (mdbNext_update (%_. (mdbNext src_node)))))" let ?goal =  "mdb_chain_0 ?m" { assume "mdbPrev src_node = 0" and T: "mdbNext src_node = 0" hence ms: "m (mdbPrev src_node) = None" using no_0 by (simp add: no_0_def) hence ?goal using T by (auto simp: modify_map_None [where m = m, OF ms] nullPointer_def
               intro!: mdb_chain_0_modify_map_0) } moreover { assume "mdbPrev src_node \<noteq> 0" and "mdbNext src_node = 0" hence ?goal apply - apply (simp add: nullMDBNode_def nullPointer_def) apply (subst modify_map_addr_com [where y = dest], simp add: neq)+ apply (rule mdb_chain_0_modify_map_0) apply (rule mdb_chain_0_modify_map_next) apply (rule mdb_chain_0_modify_map_0 [OF chain no_0]) apply clarsimp apply (clarsimp simp: dest) apply (subst next_update_is_modify [symmetric], rule dest) apply simp apply (subst next_update_lhs_rtrancl) apply simp apply (rule no_0_lhs_tranclI [OF no_0 dest_0]) apply simp apply (rule no_0_lhs_tranclI [OF no_0]) apply simp apply clarsimp done } moreover { assume "mdbPrev src_node = 0" and T: "mdbNext src_node \<noteq> 0" hence ms: "m (mdbPrev src_node) = None" using no_0 by (simp add: no_0_def) hence ?goal using T apply (simp add: modify_map_None nullPointer_def) apply (subst modify_map_addr_com [OF neq]) apply (rule mdb_chain_0_modify_map_0) apply (rule mdb_chain_0_modify_map_next [OF chain no_0 sd, OF T nsd]) apply clarsimp done } moreover { assume U: "mdbPrev src_node \<noteq> 0" and T: "mdbNext src_node \<noteq> 0" hence ?goal using dlist apply - apply (simp add: nullPointer_def) apply (subst modify_map_addr_com [where y = dest], simp add: neq)+ apply (rule mdb_chain_0_modify_map_0) apply (rule mdb_chain_0_modify_map_next) apply (rule mdb_chain_0_modify_map_next [OF chain no_0 sd nsd, OF T]) apply clarsimp apply (clarsimp simp: dest) apply (subst next_update_is_modify [symmetric], rule dest) apply simp apply (subst next_update_lhs_rtrancl) apply simp apply (rule nsd) apply simp apply (rule no_next_prev_rtrancl [OF valid], rule src, rule U) apply clarsimp done } ultimately have ?goal apply (cases "mdbPrev src_node = 0") apply (cases "mdbNext src_node = 0") apply auto[2] apply (cases "mdbNext src_node = 0") apply auto done thus "mdb_chain_0 m'" unfolding m'_def n_def apply - apply (rule mdb_chain_0_modify_map_prev) apply (subst modify_map_addr_com [OF src_neq_prev]) apply (subst modify_map_addr_com [OF prev_neq_dest2]) apply (rule mdb_chain_0_modify_map_replace) apply (subst modify_map_addr_com [OF neq_sym])+ apply (rule mdb_chain_0_modify_map_replace) apply (subst modify_map_com [ where g = "(cteCap_update (%_. cap'))"],
      case_tac x, simp)+ apply (rule mdb_chain_0_modify_map_inv) apply (subst modify_map_com [ where g = "(cteCap_update (%_. capability.NullCap))"],
      case_tac x, simp)+ apply (erule mdb_chain_0_modify_map_inv) apply simp apply simp done from valid have "valid_badges m" .. thus "valid_badges m'" using src dest parency apply (clarsimp simp: valid_badges_def2) apply (drule m'_badged)+ apply (drule m'_next) apply (clarsimp simp add: weak_derived'_def split: if_split_asm) apply (erule_tac x=src in allE, erule_tac x=p' in allE,
             erule allE, erule impE, erule exI) apply clarsimp apply (erule_tac x=p in allE, erule_tac x=src in allE,
             erule allE, erule impE, erule exI) apply clarsimp by fastforce from valid have "caps_contained' m" by (simp add: valid_mdb_ctes_def) with src dest neq parency show "caps_contained' m'" apply (clarsimp simp: caps_contained'_def) apply (drule m'_cap)+ apply (clarsimp split: if_split_asm) apply (clarsimp dest!: capRange_untyped) apply (erule_tac x=src in allE, erule_tac x=p' in allE) apply (clarsimp simp add: weak_derived'_def) apply (drule capMaster_untypedRange) apply clarsimp apply blast apply (erule_tac x=p in allE, erule_tac x=src in allE) apply (clarsimp simp: weak_derived'_def) apply (frule capMaster_isUntyped) apply (drule capMaster_capRange) apply clarsimp apply blast by fastforce show "mdb_chunked m'" by (rule chunked') from untyped_mdb show "untyped_mdb' m'" apply (simp add: untyped_mdb'_def) apply clarsimp apply (drule m'_cap)+ apply (clarsimp simp: descendants split: if_split_asm) apply (erule_tac x=src in allE) apply (erule_tac x=p' in allE) apply (simp add: src ut') apply (erule_tac x=p in allE) apply (erule_tac x=src in allE) apply (simp add: src ut') done assume isUntypedCap_eq:"isUntypedCap cap' \<Longrightarrow> cap' = src_cap" from untyped_inc show "untyped_inc' m'" using isUntypedCap_eq apply (simp add: untyped_inc'_def) apply clarsimp apply (drule m'_cap)+ apply (clarsimp simp: descendants split: if_split_asm) apply (erule_tac x=src in allE) apply (erule_tac x=p' in allE) apply (clarsimp simp add: src ut') apply (intro conjI impI) apply clarsimp+ apply (erule_tac x=p in allE) apply (erule_tac x=src in allE) apply (clarsimp simp add: src ut') apply (intro conjI impI) apply clarsimp+ apply (erule_tac x=p in allE) apply (erule_tac x=p' in allE) apply clarsimp done note if_cong [cong] from not_null parency have "src_cap \<noteq> NullCap \<and> cap' \<noteq> NullCap" by (clarsimp simp: weak_derived'_def) moreover from valid have "valid_nullcaps m" .. ultimately show vn': "valid_nullcaps m'" apply (clarsimp simp: valid_nullcaps_def) apply (frule m'_cap) apply (insert src dest) apply (frule spec, erule allE, erule (1) impE) apply (clarsimp split: if_split_asm) apply (simp add: n_def m'_def) apply (simp add: modify_map_if) apply (simp add: n_def m'_def) apply (simp add: modify_map_if) apply (clarsimp split: if_split_asm) apply (erule disjE) apply clarsimp apply (erule allE, erule allE, erule (1) impE) apply clarsimp apply (insert dlist) apply (erule_tac p=src in valid_dlistEn, assumption) apply clarsimp apply (clarsimp simp: nullMDBNode_def nullPointer_def) apply (erule allE, erule allE, erule (1) impE) apply clarsimp apply (erule_tac p=src in valid_dlistEp, assumption) apply clarsimp apply (clarsimp simp: nullMDBNode_def nullPointer_def) done from valid have "ut_revocable' m" .. thus "ut_revocable' m'" using src dest parency apply (clarsimp simp: ut_revocable'_def) apply (frule m'_cap) apply (frule m'_revocable) apply (clarsimp split: if_split_asm) apply (subgoal_tac "isUntypedCap src_cap") apply simp apply (clarsimp simp: weak_derived'_def dest!: capMaster_isUntyped) done from src have src': "m' src = Some (CTE NullCap nullMDBNode)" by (simp add: m'_def n_def modify_map_if) with dlist' no_0' have no_prev_of_src': "\<And>p. \<not>m' \<turnstile> p \<leadsto> src" apply clarsimp apply (frule (3) vdlist_nextD) apply (simp add: mdb_prev_def mdb_next_unfold nullPointer_def) done from valid have "class_links m" .. thus "class_links m'" using src dest parency apply (clarsimp simp: class_links_def weak_derived'_def) apply (case_tac cte) apply (case_tac cte') apply clarsimp apply (case_tac "p'=src") apply (simp add: no_prev_of_src') apply (drule m'_next) apply (drule m'_cap)+ apply (clarsimp split: if_split_asm) apply (fastforce dest!: capMaster_capClass) apply (fastforce dest!: capMaster_capClass) apply fastforce done show "irq_control m'" using src dest parency apply (clarsimp simp: irq_control_def) apply (frule m'_revocable) apply (drule m'_cap) apply (clarsimp split: if_split_asm) apply (clarsimp simp add: weak_derived'_def) apply (frule irq_revocable, rule irq_control) apply clarsimp apply (drule m'_cap) apply (clarsimp split: if_split_asm) apply (drule (1) irq_controlD, rule irq_control) apply simp apply (frule irq_revocable, rule irq_control) apply clarsimp apply (drule m'_cap) apply (clarsimp split: if_split_asm) apply (clarsimp simp: weak_derived'_def) apply (drule (1) irq_controlD, rule irq_control) apply simp apply (erule (1) irq_controlD, rule irq_control) done have distz: "distinct_zombies m" using valid by (simp add: valid_mdb_ctes_def) thus "distinct_zombies m'" apply (simp add: m'_def distinct_zombies_nonCTE_modify_map) apply (simp add: n_def distinct_zombies_nonCTE_modify_map
                     modify_map_apply src dest neq) apply (erule distinct_zombies_switchE, rule dest, rule src) apply simp apply (cut_tac parency) apply (clarsimp simp: weak_derived'_def) done have "reply_masters_rvk_fb m" using valid .. thus "reply_masters_rvk_fb m'" using neq parency apply (simp add: m'_def n_def reply_masters_rvk_fb_def
                     ball_ran_modify_map_eq) apply (simp add: modify_map_apply m_p dest) apply (intro ball_ran_fun_updI, simp_all) apply (frule bspec, rule ranI, rule m_p) apply (clarsimp simp: weak_derived'_def) apply (drule master_eqE[where F=isReplyCap], simp add: isCap_Master) apply (simp add: isCap_simps)+ done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_mdb_ctes m' proof (state)
goal (14 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_dlist m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> no_0 m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chain_0 m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_badges m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> caps_contained' m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chunked m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_mdb' m'
 8. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 9. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 10. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
A total of 14 subgoals... proof (state)
this:
global.sameRegionAs cap' ?c = global.sameRegionAs src_cap ?c

goal (14 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_dlist m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> no_0 m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chain_0 m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_badges m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> caps_contained' m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chunked m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_mdb' m'
 8. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 9. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 10. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
A total of 14 subgoals... proof (state)
this:
dest \<noteq> 0
src \<noteq> 0

goal (14 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_dlist m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> no_0 m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chain_0 m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_badges m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> caps_contained' m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chunked m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_mdb' m'
 8. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 9. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 10. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
A total of 14 subgoals... proof (state)
this:
m \<turnstile> src \<leadsto> mdbNext src_node

goal (14 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_dlist m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> no_0 m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chain_0 m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_badges m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> caps_contained' m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chunked m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_mdb' m'
 8. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 9. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 10. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
A total of 14 subgoals... proof (state)
this:
m \<turnstile> 0 \<leadsto>\<^sup>* ?p = (?p = 0)

goal (14 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_dlist m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> no_0 m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chain_0 m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_badges m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> caps_contained' m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chunked m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_mdb' m'
 8. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 9. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 10. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
A total of 14 subgoals... proof (prove)
goal (1 subgoal):
 1. valid_dlist m' proof (state)
this:
valid_dlist m'

goal (13 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> no_0 m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chain_0 m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_badges m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> caps_contained' m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chunked m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_mdb' m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 8. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 9. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 10. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
A total of 13 subgoals... proof (prove)
goal (1 subgoal):
 1. no_0 m' proof (state)
this:
no_0 m'

goal (12 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chain_0 m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_badges m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> caps_contained' m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chunked m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_mdb' m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 8. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 9. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 10. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
A total of 12 subgoals... proof (prove)
goal (1 subgoal):
 1. mdb_chain_0 m proof (state)
this:
mdb_chain_0 m

goal (12 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chain_0 m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_badges m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> caps_contained' m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chunked m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_mdb' m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 8. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 9. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 10. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
A total of 12 subgoals... proof (prove)
goal (1 subgoal):
 1. cte_mdb_prop m dest (\<lambda>m. mdbPrev m = nullPointer \<and> mdbNext m = nullPointer) proof (prove)
using this:
m dest = Some (CTE capability.NullCap old_dest_node)
mdbPrev old_dest_node = 0
mdbNext old_dest_node = 0

goal (1 subgoal):
 1. cte_mdb_prop m dest (\<lambda>m. mdbPrev m = nullPointer \<and> mdbNext m = nullPointer) proof (prove)
using this:
m dest = Some (CTE capability.NullCap old_dest_node)
mdbPrev old_dest_node = 0
mdbNext old_dest_node = 0

goal (1 subgoal):
 1. \<exists>cte. m dest = Some cte \<and> mdbPrev (cteMDBNode cte) = nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer proof (state)
this:
cte_mdb_prop m dest (\<lambda>m. mdbPrev m = nullPointer \<and> mdbNext m = nullPointer)

goal (12 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chain_0 m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_badges m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> caps_contained' m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chunked m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_mdb' m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 8. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 9. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 10. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
A total of 12 subgoals... proof (prove)
using this:
cte_mdb_prop m dest (\<lambda>m. mdbPrev m = nullPointer \<and> mdbNext m = nullPointer)

goal (1 subgoal):
 1. (mdbNext src_node, dest) \<notin> (mdb_next_rel m)\<^sup>* proof (prove)
using this:
cte_mdb_prop m dest (\<lambda>m. mdbPrev m = nullPointer \<and> mdbNext m = nullPointer)
valid_dlist m

goal (1 subgoal):
 1. (mdbNext src_node, dest) \<notin> (mdb_next_rel m)\<^sup>* proof (state)
this:
(mdbNext src_node, dest) \<notin> (mdb_next_rel m)\<^sup>*

goal (12 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chain_0 m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_badges m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> caps_contained' m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chunked m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_mdb' m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 8. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 9. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 10. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
A total of 12 subgoals... proof (prove)
goal (1 subgoal):
 1. mdbNext src_node \<noteq> 0 \<Longrightarrow> mdbNext src_node \<in> dom m proof (state)
goal (1 subgoal):
 1. mdbNext src_node \<noteq> 0 \<Longrightarrow> mdbNext src_node \<in> dom m proof (state)
this:
mdbNext src_node \<noteq> 0

goal (1 subgoal):
 1. mdbNext src_node \<noteq> 0 \<Longrightarrow> mdbNext src_node \<in> dom m proof (prove)
goal (1 subgoal):
 1. m \<turnstile> src \<leadsto> mdbNext src_node proof (state)
this:
m \<turnstile> src \<leadsto> mdbNext src_node

goal (1 subgoal):
 1. mdbNext src_node \<noteq> 0 \<Longrightarrow> mdbNext src_node \<in> dom m proof (state)
this:
m \<turnstile> src \<leadsto> mdbNext src_node

goal (1 subgoal):
 1. mdbNext src_node \<noteq> 0 \<Longrightarrow> mdbNext src_node \<in> dom m proof (prove)
goal (1 subgoal):
 1. m \<turnstile> src \<leadsto>\<^sup>+ 0 proof (prove)
using this:
mdb_chain_0 m
m src = Some (CTE src_cap src_node)

goal (1 subgoal):
 1. m \<turnstile> src \<leadsto>\<^sup>+ 0 proof (prove)
using this:
\<forall>x\<in>dom m. m \<turnstile> x \<leadsto>\<^sup>+ 0
m src = Some (CTE src_cap src_node)

goal (1 subgoal):
 1. m \<turnstile> src \<leadsto>\<^sup>+ 0 proof (state)
this:
m \<turnstile> src \<leadsto>\<^sup>+ 0

goal (1 subgoal):
 1. mdbNext src_node \<noteq> 0 \<Longrightarrow> mdbNext src_node \<in> dom m proof (chain)
picking this:
m \<turnstile> src \<leadsto> mdbNext src_node
m \<turnstile> src \<leadsto>\<^sup>+ 0 proof (prove)
using this:
m \<turnstile> src \<leadsto> mdbNext src_node
m \<turnstile> src \<leadsto>\<^sup>+ 0

goal (1 subgoal):
 1. m \<turnstile> mdbNext src_node \<leadsto>\<^sup>+ 0 proof (prove)
using this:
m \<turnstile> src \<leadsto> mdbNext src_node
m \<turnstile> src \<leadsto>\<^sup>+ 0
mdbNext src_node \<noteq> 0

goal (1 subgoal):
 1. m \<turnstile> mdbNext src_node \<leadsto>\<^sup>+ 0 proof (state)
this:
m \<turnstile> mdbNext src_node \<leadsto>\<^sup>+ 0

goal (1 subgoal):
 1. mdbNext src_node \<noteq> 0 \<Longrightarrow> mdbNext src_node \<in> dom m proof (prove)
using this:
m \<turnstile> mdbNext src_node \<leadsto>\<^sup>+ 0

goal (1 subgoal):
 1. mdbNext src_node \<in> dom m proof (state)
this:
mdbNext src_node \<in> dom m

goal:
No subgoals! proof (state)
this:
mdbNext src_node \<noteq> 0 \<Longrightarrow> mdbNext src_node \<in> dom m

goal (12 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chain_0 m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_badges m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> caps_contained' m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chunked m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_mdb' m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 8. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 9. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 10. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
A total of 12 subgoals... proof (state)
goal (12 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chain_0 m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_badges m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> caps_contained' m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chunked m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_mdb' m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 8. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 9. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 10. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
A total of 12 subgoals... proof (state)
goal (12 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chain_0 m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_badges m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> caps_contained' m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chunked m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_mdb' m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 8. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 9. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 10. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
A total of 12 subgoals... proof (state)
goal (12 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chain_0 m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_badges m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> caps_contained' m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chunked m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_mdb' m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 8. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 9. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 10. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
A total of 12 subgoals... proof (state)
this:
mdbPrev src_node = 0
mdbNext src_node = 0

goal (12 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chain_0 m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_badges m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> caps_contained' m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chunked m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_mdb' m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 8. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 9. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 10. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
A total of 12 subgoals... proof (prove)
using this:
mdbPrev src_node = 0
mdbNext src_node = 0

goal (1 subgoal):
 1. m (mdbPrev src_node) = None proof (prove)
using this:
mdbPrev src_node = 0
mdbNext src_node = 0
no_0 m

goal (1 subgoal):
 1. m (mdbPrev src_node) = None proof (state)
this:
m (mdbPrev src_node) = None

goal (12 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chain_0 m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_badges m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> caps_contained' m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chunked m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_mdb' m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 8. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 9. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 10. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
A total of 12 subgoals... proof (prove)
using this:
m (mdbPrev src_node) = None

goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
using this:
m (mdbPrev src_node) = None
mdbNext src_node = 0

goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (state)
this:
mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))

goal (12 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chain_0 m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_badges m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> caps_contained' m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chunked m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_mdb' m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 8. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 9. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 10. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
A total of 12 subgoals... proof (state)
this:
\<lbrakk>mdbPrev src_node = 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))

goal (12 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chain_0 m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_badges m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> caps_contained' m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chunked m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_mdb' m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 8. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 9. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 10. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
A total of 12 subgoals... proof (state)
this:
\<lbrakk>mdbPrev src_node = 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))

goal (12 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chain_0 m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_badges m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> caps_contained' m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chunked m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_mdb' m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 8. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 9. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 10. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
A total of 12 subgoals... proof (state)
this:
\<lbrakk>mdbPrev src_node = 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))

goal (12 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chain_0 m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_badges m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> caps_contained' m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chunked m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_mdb' m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 8. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 9. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 10. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
A total of 12 subgoals... proof (state)
this:
mdbPrev src_node \<noteq> 0
mdbNext src_node = 0

goal (12 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chain_0 m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_badges m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> caps_contained' m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chunked m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_mdb' m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 8. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 9. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 10. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
A total of 12 subgoals... proof (prove)
using this:
mdbPrev src_node \<noteq> 0
mdbNext src_node = 0

goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. 0)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. 0)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. 0)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. 0)))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. 0)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))
 2. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> no_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. 0)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
goal (5 subgoals):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. 0))))
 2. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> no_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. 0))))
 3. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> dest \<in> dom (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. 0))))
 4. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> (dest, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. 0)))))\<^sup>*
 5. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> no_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. 0)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> no_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. 0))))
 2. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> dest \<in> dom (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. 0))))
 3. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> (dest, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. 0)))))\<^sup>*
 4. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> no_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. 0)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> dest \<in> dom (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. 0))))
 2. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> (dest, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. 0)))))\<^sup>*
 3. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> no_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. 0)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> (dest, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. 0)))))\<^sup>*
 2. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> no_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. 0)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> ?cte20 = cteMDBNode_update (mdbNext_update (\<lambda>_. 0)) (CTE capability.NullCap old_dest_node)
 2. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> (dest, mdbPrev src_node) \<notin> (mdb_next_rel (m(dest \<mapsto> ?cte20)))\<^sup>*
 3. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> no_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. 0)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> (dest, mdbPrev src_node) \<notin> (mdb_next_rel (m(dest \<mapsto> CTE capability.NullCap (mdbNext_update (\<lambda>_. 0) old_dest_node))))\<^sup>*
 2. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> no_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. 0)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> (mdbNext (cteMDBNode (CTE capability.NullCap (mdbNext_update (\<lambda>_. 0) old_dest_node))), dest) \<notin> (mdb_next_rel m)\<^sup>*
 2. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> \<not> (dest = mdbPrev src_node \<or> m \<turnstile> mdbNext (cteMDBNode (CTE capability.NullCap (mdbNext_update (\<lambda>_. 0) old_dest_node))) \<leadsto>\<^sup>* mdbPrev src_node)
 3. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> no_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. 0)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> (0, dest) \<notin> (mdb_next_rel m)\<^sup>*
 2. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> \<not> (dest = mdbPrev src_node \<or> m \<turnstile> mdbNext (cteMDBNode (CTE capability.NullCap (mdbNext_update (\<lambda>_. 0) old_dest_node))) \<leadsto>\<^sup>* mdbPrev src_node)
 3. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> no_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. 0)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> \<not> (dest = mdbPrev src_node \<or> m \<turnstile> mdbNext (cteMDBNode (CTE capability.NullCap (mdbNext_update (\<lambda>_. 0) old_dest_node))) \<leadsto>\<^sup>* mdbPrev src_node)
 2. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> no_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. 0)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> (0, mdbPrev src_node) \<notin> (mdb_next_rel m)\<^sup>*
 2. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> no_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. 0)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> mdbPrev src_node \<noteq> 0
 2. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> no_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. 0)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> no_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. 0)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
goal:
No subgoals! proof (state)
this:
mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))

goal (12 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chain_0 m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_badges m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> caps_contained' m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chunked m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_mdb' m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 8. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 9. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 10. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
A total of 12 subgoals... proof (state)
this:
\<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))

goal (12 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chain_0 m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_badges m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> caps_contained' m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chunked m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_mdb' m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 8. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 9. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 10. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
A total of 12 subgoals... proof (state)
this:
\<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))

goal (12 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chain_0 m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_badges m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> caps_contained' m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chunked m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_mdb' m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 8. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 9. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 10. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
A total of 12 subgoals... proof (state)
this:
\<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))

goal (12 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chain_0 m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_badges m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> caps_contained' m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chunked m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_mdb' m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 8. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 9. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 10. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
A total of 12 subgoals... proof (state)
this:
mdbPrev src_node = 0
mdbNext src_node \<noteq> 0

goal (12 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chain_0 m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_badges m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> caps_contained' m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chunked m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_mdb' m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 8. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 9. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 10. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
A total of 12 subgoals... proof (prove)
using this:
mdbPrev src_node = 0
mdbNext src_node \<noteq> 0

goal (1 subgoal):
 1. m (mdbPrev src_node) = None proof (prove)
using this:
mdbPrev src_node = 0
mdbNext src_node \<noteq> 0
no_0 m

goal (1 subgoal):
 1. m (mdbPrev src_node) = None proof (state)
this:
m (mdbPrev src_node) = None

goal (12 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chain_0 m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_badges m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> caps_contained' m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chunked m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_mdb' m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 8. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 9. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 10. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
A total of 12 subgoals... proof (prove)
using this:
m (mdbPrev src_node) = None

goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
using this:
m (mdbPrev src_node) = None
mdbNext src_node \<noteq> 0

goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m (mdbPrev src_node) = None; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. 0)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m (mdbPrev src_node) = None; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. 0)))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>m (mdbPrev src_node) = None; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
 2. \<lbrakk>m (mdbPrev src_node) = None; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> no_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m (mdbPrev src_node) = None; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> no_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
goal:
No subgoals! proof (state)
this:
mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))

goal (12 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chain_0 m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_badges m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> caps_contained' m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chunked m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_mdb' m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 8. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 9. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 10. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
A total of 12 subgoals... proof (state)
this:
\<lbrakk>mdbPrev src_node = 0; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))

goal (12 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chain_0 m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_badges m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> caps_contained' m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chunked m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_mdb' m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 8. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 9. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 10. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
A total of 12 subgoals... proof (state)
this:
\<lbrakk>mdbPrev src_node = 0; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))

goal (12 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chain_0 m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_badges m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> caps_contained' m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chunked m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_mdb' m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 8. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 9. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 10. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
A total of 12 subgoals... proof (state)
this:
\<lbrakk>mdbPrev src_node = 0; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))

goal (12 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chain_0 m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_badges m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> caps_contained' m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chunked m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_mdb' m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 8. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 9. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 10. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
A total of 12 subgoals... proof (state)
this:
mdbPrev src_node \<noteq> 0
mdbNext src_node \<noteq> 0

goal (12 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chain_0 m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_badges m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> caps_contained' m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chunked m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_mdb' m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 8. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 9. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 10. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
A total of 12 subgoals... proof (prove)
using this:
mdbPrev src_node \<noteq> 0
mdbNext src_node \<noteq> 0

goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
using this:
mdbPrev src_node \<noteq> 0
mdbNext src_node \<noteq> 0
valid_dlist m

goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0; valid_dlist m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0; valid_dlist m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. 0)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0; valid_dlist m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. 0)))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0; valid_dlist m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))
 2. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0; valid_dlist m\<rbrakk> \<Longrightarrow> no_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
goal (5 subgoals):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0; valid_dlist m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
 2. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0; valid_dlist m\<rbrakk> \<Longrightarrow> no_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
 3. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0; valid_dlist m\<rbrakk> \<Longrightarrow> dest \<in> dom (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
 4. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0; valid_dlist m\<rbrakk> \<Longrightarrow> (dest, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>*
 5. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0; valid_dlist m\<rbrakk> \<Longrightarrow> no_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0; valid_dlist m\<rbrakk> \<Longrightarrow> no_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
 2. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0; valid_dlist m\<rbrakk> \<Longrightarrow> dest \<in> dom (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
 3. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0; valid_dlist m\<rbrakk> \<Longrightarrow> (dest, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>*
 4. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0; valid_dlist m\<rbrakk> \<Longrightarrow> no_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0; valid_dlist m\<rbrakk> \<Longrightarrow> dest \<in> dom (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
 2. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0; valid_dlist m\<rbrakk> \<Longrightarrow> (dest, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>*
 3. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0; valid_dlist m\<rbrakk> \<Longrightarrow> no_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0; valid_dlist m\<rbrakk> \<Longrightarrow> (dest, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>*
 2. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0; valid_dlist m\<rbrakk> \<Longrightarrow> no_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0; valid_dlist m\<rbrakk> \<Longrightarrow> ?cte22 = cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)) (CTE capability.NullCap old_dest_node)
 2. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0; valid_dlist m\<rbrakk> \<Longrightarrow> (dest, mdbPrev src_node) \<notin> (mdb_next_rel (m(dest \<mapsto> ?cte22)))\<^sup>*
 3. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0; valid_dlist m\<rbrakk> \<Longrightarrow> no_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0; valid_dlist m\<rbrakk> \<Longrightarrow> (dest, mdbPrev src_node) \<notin> (mdb_next_rel (m(dest \<mapsto> CTE capability.NullCap (mdbNext_update (\<lambda>_. mdbNext src_node) old_dest_node))))\<^sup>*
 2. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0; valid_dlist m\<rbrakk> \<Longrightarrow> no_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0; valid_dlist m\<rbrakk> \<Longrightarrow> (mdbNext (cteMDBNode (CTE capability.NullCap (mdbNext_update (\<lambda>_. mdbNext src_node) old_dest_node))), dest) \<notin> (mdb_next_rel m)\<^sup>*
 2. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0; valid_dlist m\<rbrakk> \<Longrightarrow> \<not> (dest = mdbPrev src_node \<or> m \<turnstile> mdbNext (cteMDBNode (CTE capability.NullCap (mdbNext_update (\<lambda>_. mdbNext src_node) old_dest_node))) \<leadsto>\<^sup>* mdbPrev src_node)
 3. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0; valid_dlist m\<rbrakk> \<Longrightarrow> no_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0; valid_dlist m\<rbrakk> \<Longrightarrow> (mdbNext src_node, dest) \<notin> (mdb_next_rel m)\<^sup>*
 2. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0; valid_dlist m\<rbrakk> \<Longrightarrow> \<not> (dest = mdbPrev src_node \<or> m \<turnstile> mdbNext (cteMDBNode (CTE capability.NullCap (mdbNext_update (\<lambda>_. mdbNext src_node) old_dest_node))) \<leadsto>\<^sup>* mdbPrev src_node)
 3. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0; valid_dlist m\<rbrakk> \<Longrightarrow> no_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0; valid_dlist m\<rbrakk> \<Longrightarrow> \<not> (dest = mdbPrev src_node \<or> m \<turnstile> mdbNext (cteMDBNode (CTE capability.NullCap (mdbNext_update (\<lambda>_. mdbNext src_node) old_dest_node))) \<leadsto>\<^sup>* mdbPrev src_node)
 2. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0; valid_dlist m\<rbrakk> \<Longrightarrow> no_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0; valid_dlist m\<rbrakk> \<Longrightarrow> (mdbNext src_node, mdbPrev src_node) \<notin> (mdb_next_rel m)\<^sup>*
 2. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0; valid_dlist m\<rbrakk> \<Longrightarrow> no_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0; valid_dlist m\<rbrakk> \<Longrightarrow> no_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
goal:
No subgoals! proof (state)
this:
mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))

goal (12 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chain_0 m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_badges m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> caps_contained' m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chunked m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_mdb' m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 8. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 9. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 10. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
A total of 12 subgoals... proof (state)
this:
\<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))

goal (12 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chain_0 m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_badges m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> caps_contained' m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chunked m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_mdb' m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 8. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 9. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 10. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
A total of 12 subgoals... proof (chain)
picking this:
\<lbrakk>mdbPrev src_node = 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
\<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
\<lbrakk>mdbPrev src_node = 0; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
\<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
using this:
\<lbrakk>mdbPrev src_node = 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
\<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
\<lbrakk>mdbPrev src_node = 0; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
\<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))

goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<lbrakk>mdbPrev src_node = 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node = 0; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); mdbPrev src_node = 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
 2. \<lbrakk>\<lbrakk>mdbPrev src_node = 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node = 0; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); mdbPrev src_node \<noteq> 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>\<lbrakk>mdbPrev src_node = 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node = 0; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); mdbPrev src_node = 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
 2. \<lbrakk>\<lbrakk>mdbPrev src_node = 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node = 0; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); mdbPrev src_node = 0; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
 3. \<lbrakk>\<lbrakk>mdbPrev src_node = 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node = 0; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); mdbPrev src_node \<noteq> 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<lbrakk>mdbPrev src_node = 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node = 0; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); mdbPrev src_node \<noteq> 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<lbrakk>mdbPrev src_node = 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node = 0; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
 2. \<lbrakk>\<lbrakk>mdbPrev src_node = 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node = 0; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); mdbPrev src_node \<noteq> 0; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
goal:
No subgoals! proof (state)
this:
mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))

goal (12 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chain_0 m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_badges m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> caps_contained' m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chunked m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_mdb' m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 8. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 9. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 10. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
A total of 12 subgoals... proof (prove)
using this:
mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))

goal (1 subgoal):
 1. mdb_chain_0 m' proof (prove)
using this:
mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))

goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map m dest (cteCap_update (\<lambda>_. cap'))) src (cteCap_update (\<lambda>_. capability.NullCap))) dest (cteMDBNode_update (\<lambda>m. src_node))) src (cteMDBNode_update (\<lambda>m. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (prove)
goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map m dest (cteCap_update (\<lambda>_. cap'))) src (cteCap_update (\<lambda>_. capability.NullCap))) dest (cteMDBNode_update (\<lambda>m. src_node))) src (cteMDBNode_update (\<lambda>m. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (prove)
goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m dest (cteCap_update (\<lambda>_. cap'))) src (cteCap_update (\<lambda>_. capability.NullCap))) dest (cteMDBNode_update (\<lambda>m. src_node))) src (cteMDBNode_update (\<lambda>m. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m dest (cteCap_update (\<lambda>_. cap'))) src (cteCap_update (\<lambda>_. capability.NullCap))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m dest (cteCap_update (\<lambda>_. cap'))) src (cteCap_update (\<lambda>_. capability.NullCap))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (\<lambda>m. src_node))) src (cteMDBNode_update (\<lambda>m. nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m dest (cteCap_update (\<lambda>_. cap'))) src (cteCap_update (\<lambda>_. capability.NullCap))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (\<lambda>m. src_node))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) proof (prove)
goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m src (cteCap_update (\<lambda>_. capability.NullCap))) dest (cteCap_update (\<lambda>_. cap'))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (\<lambda>m. src_node))) proof (prove)
goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m src (cteCap_update (\<lambda>_. capability.NullCap))) dest (cteCap_update (\<lambda>_. cap'))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m src (cteCap_update (\<lambda>_. capability.NullCap))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) dest (cteCap_update (\<lambda>_. cap'))) proof (prove)
goal (2 subgoals):
 1. mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteCap_update (\<lambda>_. capability.NullCap))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
 2. \<And>cte. mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) \<Longrightarrow> mdbNext (cteMDBNode (cteCap_update (\<lambda>_. cap') cte)) = mdbNext (cteMDBNode cte) proof (prove)
goal (2 subgoals):
 1. mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteCap_update (\<lambda>_. capability.NullCap)))
 2. \<And>cte. mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) \<Longrightarrow> mdbNext (cteMDBNode (cteCap_update (\<lambda>_. cap') cte)) = mdbNext (cteMDBNode cte) proof (prove)
goal (2 subgoals):
 1. \<And>cte. mdbNext (cteMDBNode (cteCap_update (\<lambda>_. capability.NullCap) cte)) = mdbNext (cteMDBNode cte)
 2. \<And>cte. mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) \<Longrightarrow> mdbNext (cteMDBNode (cteCap_update (\<lambda>_. cap') cte)) = mdbNext (cteMDBNode cte) proof (prove)
goal (1 subgoal):
 1. \<And>cte. mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext nullMDBNode)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) \<Longrightarrow> mdbNext (cteMDBNode (cteCap_update (\<lambda>_. cap') cte)) = mdbNext (cteMDBNode cte) proof (prove)
goal:
No subgoals! proof (state)
this:
mdb_chain_0 m'

goal (11 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_badges m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> caps_contained' m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chunked m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_mdb' m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 8. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 9. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
 10. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> irq_control m'
A total of 11 subgoals... proof (chain)
picking this:
valid_mdb_ctes m proof (prove)
using this:
valid_mdb_ctes m

goal (1 subgoal):
 1. valid_badges m proof (state)
this:
valid_badges m

goal (11 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_badges m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> caps_contained' m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chunked m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_mdb' m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 8. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 9. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
 10. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> irq_control m'
A total of 11 subgoals... proof (prove)
using this:
valid_badges m

goal (1 subgoal):
 1. valid_badges m' proof (prove)
using this:
valid_badges m
m src = Some (CTE src_cap src_node)
m dest = Some (CTE capability.NullCap old_dest_node)
weak_derived' src_cap cap'

goal (1 subgoal):
 1. valid_badges m' proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap node cap'a node' y. \<lbrakk>\<forall>p p' cap. (\<exists>node. m p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. m p' = Some (CTE cap' node') \<longrightarrow> m \<turnstile> p \<leadsto> p' \<longrightarrow> capMasterCap cap = capMasterCap cap' \<longrightarrow> (\<exists>y. capBadge cap = Some y) \<longrightarrow> capBadge cap \<noteq> capBadge cap' \<longrightarrow> capBadge cap' \<noteq> Some 0 \<longrightarrow> mdbFirstBadged node'); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); weak_derived' src_cap cap'; m' p = Some (CTE cap node); m' p' = Some (CTE cap'a node'); m' \<turnstile> p \<leadsto> p'; capMasterCap cap = capMasterCap cap'a; capBadge cap = Some y; Some y \<noteq> capBadge cap'a; capBadge cap'a \<noteq> Some 0\<rbrakk> \<Longrightarrow> mdbFirstBadged node' proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap node cap'a node' y. \<lbrakk>\<forall>p p' cap. (\<exists>node. m p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. m p' = Some (CTE cap' node') \<longrightarrow> m \<turnstile> p \<leadsto> p' \<longrightarrow> capMasterCap cap = capMasterCap cap' \<longrightarrow> (\<exists>y. capBadge cap = Some y) \<longrightarrow> capBadge cap \<noteq> capBadge cap' \<longrightarrow> capBadge cap' \<noteq> Some 0 \<longrightarrow> mdbFirstBadged node'); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); weak_derived' src_cap cap'; m' \<turnstile> p \<leadsto> p'; capMasterCap cap = capMasterCap cap'a; capBadge cap = Some y; Some y \<noteq> capBadge cap'a; capBadge cap'a \<noteq> Some 0; if p = dest then mdbFirstBadged node = mdbFirstBadged src_node \<and> cap = cap' else if p = src then \<not> mdbFirstBadged node \<and> cap = capability.NullCap else \<exists>node'. m p = Some (CTE cap node') \<and> mdbFirstBadged node = mdbFirstBadged node'; if p' = dest then mdbFirstBadged node' = mdbFirstBadged src_node \<and> cap'a = cap' else if p' = src then \<not> mdbFirstBadged node' \<and> cap'a = capability.NullCap else \<exists>node'a. m p' = Some (CTE cap'a node'a) \<and> mdbFirstBadged node' = mdbFirstBadged node'a\<rbrakk> \<Longrightarrow> mdbFirstBadged node' proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap node cap'a node' y. \<lbrakk>\<forall>p p' cap. (\<exists>node. m p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. m p' = Some (CTE cap' node') \<longrightarrow> m \<turnstile> p \<leadsto> p' \<longrightarrow> capMasterCap cap = capMasterCap cap' \<longrightarrow> (\<exists>y. capBadge cap = Some y) \<longrightarrow> capBadge cap \<noteq> capBadge cap' \<longrightarrow> capBadge cap' \<noteq> Some 0 \<longrightarrow> mdbFirstBadged node'); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); weak_derived' src_cap cap'; capMasterCap cap = capMasterCap cap'a; capBadge cap = Some y; Some y \<noteq> capBadge cap'a; capBadge cap'a \<noteq> Some 0; if p = dest then mdbFirstBadged node = mdbFirstBadged src_node \<and> cap = cap' else if p = src then \<not> mdbFirstBadged node \<and> cap = capability.NullCap else \<exists>node'. m p = Some (CTE cap node') \<and> mdbFirstBadged node = mdbFirstBadged node'; if p' = dest then mdbFirstBadged node' = mdbFirstBadged src_node \<and> cap'a = cap' else if p' = src then \<not> mdbFirstBadged node' \<and> cap'a = capability.NullCap else \<exists>node'a. m p' = Some (CTE cap'a node'a) \<and> mdbFirstBadged node' = mdbFirstBadged node'a; if p = src then p' = 0 else if p = dest then m \<turnstile> src \<leadsto> p' else if p' = dest then m \<turnstile> p \<leadsto> src else m \<turnstile> p \<leadsto> p'\<rbrakk> \<Longrightarrow> mdbFirstBadged node' proof (prove)
goal (3 subgoals):
 1. \<And>p' node cap'a node' y node'a. \<lbrakk>m \<turnstile> src \<leadsto> p'; \<forall>p p' cap. (\<exists>node. m p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. m p' = Some (CTE cap' node') \<longrightarrow> m \<turnstile> p \<leadsto> p' \<longrightarrow> capMasterCap cap = capMasterCap cap' \<longrightarrow> (\<exists>y. capBadge cap = Some y) \<longrightarrow> capBadge cap \<noteq> capBadge cap' \<longrightarrow> capBadge cap' \<noteq> Some 0 \<longrightarrow> mdbFirstBadged node'); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); capMasterCap cap' = capMasterCap cap'a; capBadge cap' = Some y; Some y \<noteq> capBadge cap'a; capBadge cap'a \<noteq> Some 0; capMasterCap src_cap = capMasterCap cap'a; capBadge src_cap = Some y; capASID src_cap = capASID cap'; cap_asid_base' src_cap = cap_asid_base' cap'; cap_vptr' src_cap = cap_vptr' cap'; isReplyCap src_cap \<longrightarrow> capTCBPtr src_cap = capTCBPtr cap' \<and> capReplyMaster src_cap = capReplyMaster cap'; mdbFirstBadged node = mdbFirstBadged src_node; p' \<noteq> dest; p' \<noteq> src; m p' = Some (CTE cap'a node'a); \<not> mdbFirstBadged node'; \<not> mdbFirstBadged node'a\<rbrakk> \<Longrightarrow> False
 2. \<And>p cap node node' y node'a. \<lbrakk>\<forall>p p' cap. (\<exists>node. m p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. m p' = Some (CTE cap' node') \<longrightarrow> m \<turnstile> p \<leadsto> p' \<longrightarrow> capMasterCap cap = capMasterCap cap' \<longrightarrow> (\<exists>y. capBadge cap = Some y) \<longrightarrow> capBadge cap \<noteq> capBadge cap' \<longrightarrow> capBadge cap' \<noteq> Some 0 \<longrightarrow> mdbFirstBadged node'); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); capMasterCap cap = capMasterCap cap'; capBadge cap = Some y; Some y \<noteq> capBadge cap'; capBadge cap' \<noteq> Some 0; p \<noteq> dest; capMasterCap src_cap = capMasterCap cap'; capBadge src_cap = capBadge cap'; capASID src_cap = capASID cap'; cap_asid_base' src_cap = cap_asid_base' cap'; cap_vptr' src_cap = cap_vptr' cap'; isReplyCap src_cap \<longrightarrow> capTCBPtr src_cap = capTCBPtr cap' \<and> capReplyMaster src_cap = capReplyMaster cap'; p \<noteq> src; m \<turnstile> p \<leadsto> src; m p = Some (CTE cap node'a); mdbFirstBadged node = mdbFirstBadged node'a; \<not> mdbFirstBadged node'; \<not> mdbFirstBadged src_node\<rbrakk> \<Longrightarrow> False
 3. \<And>p p' cap node cap'a node' y node'a node'b. \<lbrakk>p \<noteq> src; m \<turnstile> p \<leadsto> p'; \<forall>p p' cap. (\<exists>node. m p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. m p' = Some (CTE cap' node') \<longrightarrow> m \<turnstile> p \<leadsto> p' \<longrightarrow> capMasterCap cap = capMasterCap cap' \<longrightarrow> (\<exists>y. capBadge cap = Some y) \<longrightarrow> capBadge cap \<noteq> capBadge cap' \<longrightarrow> capBadge cap' \<noteq> Some 0 \<longrightarrow> mdbFirstBadged node'); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); capMasterCap cap = capMasterCap cap'a; capBadge cap = Some y; Some y \<noteq> capBadge cap'a; capBadge cap'a \<noteq> Some 0; p \<noteq> dest; capMasterCap src_cap = capMasterCap cap'; capBadge src_cap = capBadge cap'; capASID src_cap = capASID cap'; cap_asid_base' src_cap = cap_asid_base' cap'; cap_vptr' src_cap = cap_vptr' cap'; isReplyCap src_cap \<longrightarrow> capTCBPtr src_cap = capTCBPtr cap' \<and> capReplyMaster src_cap = capReplyMaster cap'; p' \<noteq> dest; p' \<noteq> src; m p = Some (CTE cap node'a); mdbFirstBadged node = mdbFirstBadged node'a; m p' = Some (CTE cap'a node'b); \<not> mdbFirstBadged node'; \<not> mdbFirstBadged node'b\<rbrakk> \<Longrightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>p' node cap'a node' y node'a. \<lbrakk>m \<turnstile> src \<leadsto> p'; m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); capMasterCap cap' = capMasterCap cap'a; capBadge cap' = Some y; Some y \<noteq> capBadge cap'a; capBadge cap'a \<noteq> Some 0; capMasterCap src_cap = capMasterCap cap'a; capBadge src_cap = Some y; capASID src_cap = capASID cap'; cap_asid_base' src_cap = cap_asid_base' cap'; cap_vptr' src_cap = cap_vptr' cap'; isReplyCap src_cap \<longrightarrow> capTCBPtr src_cap = capTCBPtr cap' \<and> capReplyMaster src_cap = capReplyMaster cap'; mdbFirstBadged node = mdbFirstBadged src_node; p' \<noteq> dest; p' \<noteq> src; m p' = Some (CTE cap'a node'a); \<not> mdbFirstBadged node'; \<not> mdbFirstBadged node'a; \<forall>cap' node'. m p' = Some (CTE cap' node') \<longrightarrow> m \<turnstile> src \<leadsto> p' \<longrightarrow> capMasterCap src_cap = capMasterCap cap' \<longrightarrow> (\<exists>y. capBadge src_cap = Some y) \<longrightarrow> capBadge src_cap \<noteq> capBadge cap' \<longrightarrow> capBadge cap' \<noteq> Some 0 \<longrightarrow> mdbFirstBadged node'\<rbrakk> \<Longrightarrow> False
 2. \<And>p cap node node' y node'a. \<lbrakk>\<forall>p p' cap. (\<exists>node. m p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. m p' = Some (CTE cap' node') \<longrightarrow> m \<turnstile> p \<leadsto> p' \<longrightarrow> capMasterCap cap = capMasterCap cap' \<longrightarrow> (\<exists>y. capBadge cap = Some y) \<longrightarrow> capBadge cap \<noteq> capBadge cap' \<longrightarrow> capBadge cap' \<noteq> Some 0 \<longrightarrow> mdbFirstBadged node'); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); capMasterCap cap = capMasterCap cap'; capBadge cap = Some y; Some y \<noteq> capBadge cap'; capBadge cap' \<noteq> Some 0; p \<noteq> dest; capMasterCap src_cap = capMasterCap cap'; capBadge src_cap = capBadge cap'; capASID src_cap = capASID cap'; cap_asid_base' src_cap = cap_asid_base' cap'; cap_vptr' src_cap = cap_vptr' cap'; isReplyCap src_cap \<longrightarrow> capTCBPtr src_cap = capTCBPtr cap' \<and> capReplyMaster src_cap = capReplyMaster cap'; p \<noteq> src; m \<turnstile> p \<leadsto> src; m p = Some (CTE cap node'a); mdbFirstBadged node = mdbFirstBadged node'a; \<not> mdbFirstBadged node'; \<not> mdbFirstBadged src_node\<rbrakk> \<Longrightarrow> False
 3. \<And>p p' cap node cap'a node' y node'a node'b. \<lbrakk>p \<noteq> src; m \<turnstile> p \<leadsto> p'; \<forall>p p' cap. (\<exists>node. m p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. m p' = Some (CTE cap' node') \<longrightarrow> m \<turnstile> p \<leadsto> p' \<longrightarrow> capMasterCap cap = capMasterCap cap' \<longrightarrow> (\<exists>y. capBadge cap = Some y) \<longrightarrow> capBadge cap \<noteq> capBadge cap' \<longrightarrow> capBadge cap' \<noteq> Some 0 \<longrightarrow> mdbFirstBadged node'); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); capMasterCap cap = capMasterCap cap'a; capBadge cap = Some y; Some y \<noteq> capBadge cap'a; capBadge cap'a \<noteq> Some 0; p \<noteq> dest; capMasterCap src_cap = capMasterCap cap'; capBadge src_cap = capBadge cap'; capASID src_cap = capASID cap'; cap_asid_base' src_cap = cap_asid_base' cap'; cap_vptr' src_cap = cap_vptr' cap'; isReplyCap src_cap \<longrightarrow> capTCBPtr src_cap = capTCBPtr cap' \<and> capReplyMaster src_cap = capReplyMaster cap'; p' \<noteq> dest; p' \<noteq> src; m p = Some (CTE cap node'a); mdbFirstBadged node = mdbFirstBadged node'a; m p' = Some (CTE cap'a node'b); \<not> mdbFirstBadged node'; \<not> mdbFirstBadged node'b\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>p cap node node' y node'a. \<lbrakk>\<forall>p p' cap. (\<exists>node. m p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. m p' = Some (CTE cap' node') \<longrightarrow> m \<turnstile> p \<leadsto> p' \<longrightarrow> capMasterCap cap = capMasterCap cap' \<longrightarrow> (\<exists>y. capBadge cap = Some y) \<longrightarrow> capBadge cap \<noteq> capBadge cap' \<longrightarrow> capBadge cap' \<noteq> Some 0 \<longrightarrow> mdbFirstBadged node'); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); capMasterCap cap = capMasterCap cap'; capBadge cap = Some y; Some y \<noteq> capBadge cap'; capBadge cap' \<noteq> Some 0; p \<noteq> dest; capMasterCap src_cap = capMasterCap cap'; capBadge src_cap = capBadge cap'; capASID src_cap = capASID cap'; cap_asid_base' src_cap = cap_asid_base' cap'; cap_vptr' src_cap = cap_vptr' cap'; isReplyCap src_cap \<longrightarrow> capTCBPtr src_cap = capTCBPtr cap' \<and> capReplyMaster src_cap = capReplyMaster cap'; p \<noteq> src; m \<turnstile> p \<leadsto> src; m p = Some (CTE cap node'a); mdbFirstBadged node = mdbFirstBadged node'a; \<not> mdbFirstBadged node'; \<not> mdbFirstBadged src_node\<rbrakk> \<Longrightarrow> False
 2. \<And>p p' cap node cap'a node' y node'a node'b. \<lbrakk>p \<noteq> src; m \<turnstile> p \<leadsto> p'; \<forall>p p' cap. (\<exists>node. m p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. m p' = Some (CTE cap' node') \<longrightarrow> m \<turnstile> p \<leadsto> p' \<longrightarrow> capMasterCap cap = capMasterCap cap' \<longrightarrow> (\<exists>y. capBadge cap = Some y) \<longrightarrow> capBadge cap \<noteq> capBadge cap' \<longrightarrow> capBadge cap' \<noteq> Some 0 \<longrightarrow> mdbFirstBadged node'); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); capMasterCap cap = capMasterCap cap'a; capBadge cap = Some y; Some y \<noteq> capBadge cap'a; capBadge cap'a \<noteq> Some 0; p \<noteq> dest; capMasterCap src_cap = capMasterCap cap'; capBadge src_cap = capBadge cap'; capASID src_cap = capASID cap'; cap_asid_base' src_cap = cap_asid_base' cap'; cap_vptr' src_cap = cap_vptr' cap'; isReplyCap src_cap \<longrightarrow> capTCBPtr src_cap = capTCBPtr cap' \<and> capReplyMaster src_cap = capReplyMaster cap'; p' \<noteq> dest; p' \<noteq> src; m p = Some (CTE cap node'a); mdbFirstBadged node = mdbFirstBadged node'a; m p' = Some (CTE cap'a node'b); \<not> mdbFirstBadged node'; \<not> mdbFirstBadged node'b\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>p cap node node' y node'a. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); capMasterCap cap = capMasterCap cap'; capBadge cap = Some y; Some y \<noteq> capBadge cap'; capBadge cap' \<noteq> Some 0; p \<noteq> dest; capMasterCap src_cap = capMasterCap cap'; capBadge src_cap = capBadge cap'; capASID src_cap = capASID cap'; cap_asid_base' src_cap = cap_asid_base' cap'; cap_vptr' src_cap = cap_vptr' cap'; isReplyCap src_cap \<longrightarrow> capTCBPtr src_cap = capTCBPtr cap' \<and> capReplyMaster src_cap = capReplyMaster cap'; p \<noteq> src; m \<turnstile> p \<leadsto> src; m p = Some (CTE cap node'a); mdbFirstBadged node = mdbFirstBadged node'a; \<not> mdbFirstBadged node'; \<not> mdbFirstBadged src_node; \<forall>cap' node'. m src = Some (CTE cap' node') \<longrightarrow> m \<turnstile> p \<leadsto> src \<longrightarrow> capMasterCap cap = capMasterCap cap' \<longrightarrow> (\<exists>y. capBadge cap = Some y) \<longrightarrow> capBadge cap \<noteq> capBadge cap' \<longrightarrow> capBadge cap' \<noteq> Some 0 \<longrightarrow> mdbFirstBadged node'\<rbrakk> \<Longrightarrow> False
 2. \<And>p p' cap node cap'a node' y node'a node'b. \<lbrakk>p \<noteq> src; m \<turnstile> p \<leadsto> p'; \<forall>p p' cap. (\<exists>node. m p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. m p' = Some (CTE cap' node') \<longrightarrow> m \<turnstile> p \<leadsto> p' \<longrightarrow> capMasterCap cap = capMasterCap cap' \<longrightarrow> (\<exists>y. capBadge cap = Some y) \<longrightarrow> capBadge cap \<noteq> capBadge cap' \<longrightarrow> capBadge cap' \<noteq> Some 0 \<longrightarrow> mdbFirstBadged node'); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); capMasterCap cap = capMasterCap cap'a; capBadge cap = Some y; Some y \<noteq> capBadge cap'a; capBadge cap'a \<noteq> Some 0; p \<noteq> dest; capMasterCap src_cap = capMasterCap cap'; capBadge src_cap = capBadge cap'; capASID src_cap = capASID cap'; cap_asid_base' src_cap = cap_asid_base' cap'; cap_vptr' src_cap = cap_vptr' cap'; isReplyCap src_cap \<longrightarrow> capTCBPtr src_cap = capTCBPtr cap' \<and> capReplyMaster src_cap = capReplyMaster cap'; p' \<noteq> dest; p' \<noteq> src; m p = Some (CTE cap node'a); mdbFirstBadged node = mdbFirstBadged node'a; m p' = Some (CTE cap'a node'b); \<not> mdbFirstBadged node'; \<not> mdbFirstBadged node'b\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap node cap'a node' y node'a node'b. \<lbrakk>p \<noteq> src; m \<turnstile> p \<leadsto> p'; \<forall>p p' cap. (\<exists>node. m p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. m p' = Some (CTE cap' node') \<longrightarrow> m \<turnstile> p \<leadsto> p' \<longrightarrow> capMasterCap cap = capMasterCap cap' \<longrightarrow> (\<exists>y. capBadge cap = Some y) \<longrightarrow> capBadge cap \<noteq> capBadge cap' \<longrightarrow> capBadge cap' \<noteq> Some 0 \<longrightarrow> mdbFirstBadged node'); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); capMasterCap cap = capMasterCap cap'a; capBadge cap = Some y; Some y \<noteq> capBadge cap'a; capBadge cap'a \<noteq> Some 0; p \<noteq> dest; capMasterCap src_cap = capMasterCap cap'; capBadge src_cap = capBadge cap'; capASID src_cap = capASID cap'; cap_asid_base' src_cap = cap_asid_base' cap'; cap_vptr' src_cap = cap_vptr' cap'; isReplyCap src_cap \<longrightarrow> capTCBPtr src_cap = capTCBPtr cap' \<and> capReplyMaster src_cap = capReplyMaster cap'; p' \<noteq> dest; p' \<noteq> src; m p = Some (CTE cap node'a); mdbFirstBadged node = mdbFirstBadged node'a; m p' = Some (CTE cap'a node'b); \<not> mdbFirstBadged node'; \<not> mdbFirstBadged node'b\<rbrakk> \<Longrightarrow> False proof (state)
this:
valid_badges m'

goal (10 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> caps_contained' m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chunked m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_mdb' m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 8. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
 9. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> irq_control m'
 10. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> reply_masters_rvk_fb m' proof (chain)
picking this:
valid_mdb_ctes m proof (prove)
using this:
valid_mdb_ctes m

goal (1 subgoal):
 1. caps_contained' m proof (state)
this:
caps_contained' m

goal (10 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> caps_contained' m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chunked m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_mdb' m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 8. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
 9. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> irq_control m'
 10. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> reply_masters_rvk_fb m' proof (chain)
picking this:
m src = Some (CTE src_cap src_node)
m dest = Some (CTE capability.NullCap old_dest_node)
src \<noteq> dest
weak_derived' src_cap cap'
caps_contained' m proof (prove)
using this:
m src = Some (CTE src_cap src_node)
m dest = Some (CTE capability.NullCap old_dest_node)
src \<noteq> dest
weak_derived' src_cap cap'
caps_contained' m

goal (1 subgoal):
 1. caps_contained' m' proof (prove)
goal (1 subgoal):
 1. \<And>p p' c n c' n' x. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); src \<noteq> dest; weak_derived' src_cap cap'; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); m' p = Some (CTE c n); m' p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (1 subgoal):
 1. \<And>p p' c n c' n' x. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); src \<noteq> dest; weak_derived' src_cap cap'; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; if p = src then c = capability.NullCap else if p = dest then c = cap' else \<exists>node'. m p = Some (CTE c node'); if p' = src then c' = capability.NullCap else if p' = dest then c' = cap' else \<exists>node'. m p' = Some (CTE c' node')\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (4 subgoals):
 1. \<And>x. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); src \<noteq> dest; weak_derived' src_cap cap'; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); \<not> isUntypedCap cap'; capRange cap' \<inter> untypedRange cap' \<noteq> {}; x \<in> capRange cap'\<rbrakk> \<Longrightarrow> x \<in> untypedRange cap'
 2. \<And>p' c' x node'. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); src \<noteq> dest; weak_derived' src_cap cap'; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange cap' \<noteq> {}; x \<in> capRange c'; p' \<noteq> src; p' \<noteq> dest; m p' = Some (CTE c' node')\<rbrakk> \<Longrightarrow> x \<in> untypedRange cap'
 3. \<And>p c x node'. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); src \<noteq> dest; weak_derived' src_cap cap'; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); \<not> isUntypedCap cap'; capRange cap' \<inter> untypedRange c \<noteq> {}; x \<in> capRange cap'; p \<noteq> src; p \<noteq> dest; m p = Some (CTE c node')\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 4. \<And>p p' c c' x node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); src \<noteq> dest; weak_derived' src_cap cap'; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> src; p \<noteq> dest; p' \<noteq> src; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (3 subgoals):
 1. \<And>p' c' x node'. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); src \<noteq> dest; weak_derived' src_cap cap'; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange cap' \<noteq> {}; x \<in> capRange c'; p' \<noteq> src; p' \<noteq> dest; m p' = Some (CTE c' node')\<rbrakk> \<Longrightarrow> x \<in> untypedRange cap'
 2. \<And>p c x node'. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); src \<noteq> dest; weak_derived' src_cap cap'; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); \<not> isUntypedCap cap'; capRange cap' \<inter> untypedRange c \<noteq> {}; x \<in> capRange cap'; p \<noteq> src; p \<noteq> dest; m p = Some (CTE c node')\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 3. \<And>p p' c c' x node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); src \<noteq> dest; weak_derived' src_cap cap'; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> src; p \<noteq> dest; p' \<noteq> src; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (3 subgoals):
 1. \<And>p' c' x node'. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); src \<noteq> dest; weak_derived' src_cap cap'; \<not> isUntypedCap c'; capRange c' \<inter> untypedRange cap' \<noteq> {}; x \<in> capRange c'; p' \<noteq> src; p' \<noteq> dest; m p' = Some (CTE c' node'); \<forall>c. (\<exists>n. m src = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c)\<rbrakk> \<Longrightarrow> x \<in> untypedRange cap'
 2. \<And>p c x node'. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); src \<noteq> dest; weak_derived' src_cap cap'; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); \<not> isUntypedCap cap'; capRange cap' \<inter> untypedRange c \<noteq> {}; x \<in> capRange cap'; p \<noteq> src; p \<noteq> dest; m p = Some (CTE c node')\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 3. \<And>p p' c c' x node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); src \<noteq> dest; weak_derived' src_cap cap'; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> src; p \<noteq> dest; p' \<noteq> src; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (3 subgoals):
 1. \<And>p' c' x node'. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); src \<noteq> dest; \<not> isUntypedCap c'; capRange c' \<inter> untypedRange cap' \<noteq> {}; x \<in> capRange c'; p' \<noteq> src; p' \<noteq> dest; m p' = Some (CTE c' node'); capRange c' \<inter> untypedRange src_cap \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange src_cap; capMasterCap src_cap = capMasterCap cap'; capBadge src_cap = capBadge cap'; capASID src_cap = capASID cap'; cap_asid_base' src_cap = cap_asid_base' cap'; cap_vptr' src_cap = cap_vptr' cap'; isReplyCap src_cap \<longrightarrow> capTCBPtr src_cap = capTCBPtr cap' \<and> capReplyMaster src_cap = capReplyMaster cap'\<rbrakk> \<Longrightarrow> x \<in> untypedRange cap'
 2. \<And>p c x node'. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); src \<noteq> dest; weak_derived' src_cap cap'; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); \<not> isUntypedCap cap'; capRange cap' \<inter> untypedRange c \<noteq> {}; x \<in> capRange cap'; p \<noteq> src; p \<noteq> dest; m p = Some (CTE c node')\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 3. \<And>p p' c c' x node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); src \<noteq> dest; weak_derived' src_cap cap'; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> src; p \<noteq> dest; p' \<noteq> src; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (3 subgoals):
 1. \<And>p' c' x node'. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); src \<noteq> dest; \<not> isUntypedCap c'; capRange c' \<inter> untypedRange cap' \<noteq> {}; x \<in> capRange c'; p' \<noteq> src; p' \<noteq> dest; m p' = Some (CTE c' node'); capRange c' \<inter> untypedRange src_cap \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange src_cap; capBadge src_cap = capBadge cap'; capASID src_cap = capASID cap'; cap_asid_base' src_cap = cap_asid_base' cap'; cap_vptr' src_cap = cap_vptr' cap'; isReplyCap src_cap \<longrightarrow> capTCBPtr src_cap = capTCBPtr cap' \<and> capReplyMaster src_cap = capReplyMaster cap'; untypedRange src_cap = untypedRange cap'\<rbrakk> \<Longrightarrow> x \<in> untypedRange cap'
 2. \<And>p c x node'. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); src \<noteq> dest; weak_derived' src_cap cap'; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); \<not> isUntypedCap cap'; capRange cap' \<inter> untypedRange c \<noteq> {}; x \<in> capRange cap'; p \<noteq> src; p \<noteq> dest; m p = Some (CTE c node')\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 3. \<And>p p' c c' x node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); src \<noteq> dest; weak_derived' src_cap cap'; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> src; p \<noteq> dest; p' \<noteq> src; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (3 subgoals):
 1. \<And>p' c' x node'. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); src \<noteq> dest; \<not> isUntypedCap c'; capRange c' \<inter> untypedRange cap' \<noteq> {}; x \<in> capRange c'; p' \<noteq> src; p' \<noteq> dest; m p' = Some (CTE c' node'); capRange c' \<subseteq> untypedRange cap'; capBadge src_cap = capBadge cap'; capASID src_cap = capASID cap'; cap_asid_base' src_cap = cap_asid_base' cap'; cap_vptr' src_cap = cap_vptr' cap'; isReplyCap src_cap \<longrightarrow> capTCBPtr src_cap = capTCBPtr cap' \<and> capReplyMaster src_cap = capReplyMaster cap'; untypedRange src_cap = untypedRange cap'\<rbrakk> \<Longrightarrow> x \<in> untypedRange cap'
 2. \<And>p c x node'. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); src \<noteq> dest; weak_derived' src_cap cap'; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); \<not> isUntypedCap cap'; capRange cap' \<inter> untypedRange c \<noteq> {}; x \<in> capRange cap'; p \<noteq> src; p \<noteq> dest; m p = Some (CTE c node')\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 3. \<And>p p' c c' x node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); src \<noteq> dest; weak_derived' src_cap cap'; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> src; p \<noteq> dest; p' \<noteq> src; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (2 subgoals):
 1. \<And>p c x node'. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); src \<noteq> dest; weak_derived' src_cap cap'; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); \<not> isUntypedCap cap'; capRange cap' \<inter> untypedRange c \<noteq> {}; x \<in> capRange cap'; p \<noteq> src; p \<noteq> dest; m p = Some (CTE c node')\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. \<And>p p' c c' x node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); src \<noteq> dest; weak_derived' src_cap cap'; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> src; p \<noteq> dest; p' \<noteq> src; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (2 subgoals):
 1. \<And>p c x node'. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); src \<noteq> dest; weak_derived' src_cap cap'; \<not> isUntypedCap cap'; capRange cap' \<inter> untypedRange c \<noteq> {}; x \<in> capRange cap'; p \<noteq> src; p \<noteq> dest; m p = Some (CTE c node'); \<forall>c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. m src = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. \<And>p p' c c' x node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); src \<noteq> dest; weak_derived' src_cap cap'; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> src; p \<noteq> dest; p' \<noteq> src; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (2 subgoals):
 1. \<And>p c x node'. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); src \<noteq> dest; \<not> isUntypedCap cap'; capRange cap' \<inter> untypedRange c \<noteq> {}; x \<in> capRange cap'; p \<noteq> src; p \<noteq> dest; m p = Some (CTE c node'); \<not> isUntypedCap src_cap \<longrightarrow> capRange src_cap \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange src_cap \<subseteq> untypedRange c; capMasterCap src_cap = capMasterCap cap'; capBadge src_cap = capBadge cap'; capASID src_cap = capASID cap'; cap_asid_base' src_cap = cap_asid_base' cap'; cap_vptr' src_cap = cap_vptr' cap'; isReplyCap src_cap \<longrightarrow> capTCBPtr src_cap = capTCBPtr cap' \<and> capReplyMaster src_cap = capReplyMaster cap'\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. \<And>p p' c c' x node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); src \<noteq> dest; weak_derived' src_cap cap'; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> src; p \<noteq> dest; p' \<noteq> src; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (2 subgoals):
 1. \<And>p c x node'. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); src \<noteq> dest; \<not> isUntypedCap cap'; capRange cap' \<inter> untypedRange c \<noteq> {}; x \<in> capRange cap'; p \<noteq> src; p \<noteq> dest; m p = Some (CTE c node'); \<not> isUntypedCap src_cap \<longrightarrow> capRange src_cap \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange src_cap \<subseteq> untypedRange c; capMasterCap src_cap = capMasterCap cap'; capBadge src_cap = capBadge cap'; capASID src_cap = capASID cap'; cap_asid_base' src_cap = cap_asid_base' cap'; cap_vptr' src_cap = cap_vptr' cap'; isReplyCap src_cap \<longrightarrow> capTCBPtr src_cap = capTCBPtr cap' \<and> capReplyMaster src_cap = capReplyMaster cap'; isUntypedCap src_cap = isUntypedCap cap'\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. \<And>p p' c c' x node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); src \<noteq> dest; weak_derived' src_cap cap'; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> src; p \<noteq> dest; p' \<noteq> src; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (2 subgoals):
 1. \<And>p c x node'. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); src \<noteq> dest; \<not> isUntypedCap cap'; capRange cap' \<inter> untypedRange c \<noteq> {}; x \<in> capRange cap'; p \<noteq> src; p \<noteq> dest; m p = Some (CTE c node'); \<not> isUntypedCap src_cap \<longrightarrow> capRange src_cap \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange src_cap \<subseteq> untypedRange c; capBadge src_cap = capBadge cap'; capASID src_cap = capASID cap'; cap_asid_base' src_cap = cap_asid_base' cap'; cap_vptr' src_cap = cap_vptr' cap'; isReplyCap src_cap \<longrightarrow> capTCBPtr src_cap = capTCBPtr cap' \<and> capReplyMaster src_cap = capReplyMaster cap'; isUntypedCap src_cap = isUntypedCap cap'; capRange src_cap = capRange cap'\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. \<And>p p' c c' x node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); src \<noteq> dest; weak_derived' src_cap cap'; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> src; p \<noteq> dest; p' \<noteq> src; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (2 subgoals):
 1. \<And>p c x node'. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); src \<noteq> dest; \<not> isUntypedCap cap'; capRange cap' \<inter> untypedRange c \<noteq> {}; x \<in> capRange cap'; p \<noteq> src; p \<noteq> dest; m p = Some (CTE c node'); capRange cap' \<subseteq> untypedRange c; capBadge src_cap = capBadge cap'; capASID src_cap = capASID cap'; cap_asid_base' src_cap = cap_asid_base' cap'; cap_vptr' src_cap = cap_vptr' cap'; isReplyCap src_cap \<longrightarrow> capTCBPtr src_cap = capTCBPtr cap' \<and> capReplyMaster src_cap = capReplyMaster cap'; \<not> isUntypedCap src_cap; capRange src_cap = capRange cap'\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. \<And>p p' c c' x node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); src \<noteq> dest; weak_derived' src_cap cap'; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> src; p \<noteq> dest; p' \<noteq> src; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (1 subgoal):
 1. \<And>p p' c c' x node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); src \<noteq> dest; weak_derived' src_cap cap'; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> src; p \<noteq> dest; p' \<noteq> src; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (state)
this:
caps_contained' m'

goal (9 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> mdb_chunked m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_mdb' m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
 8. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> irq_control m'
 9. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> reply_masters_rvk_fb m' proof (prove)
goal (1 subgoal):
 1. mdb_chunked m' proof (state)
this:
mdb_chunked m'

goal (8 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_mdb' m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> irq_control m'
 8. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> reply_masters_rvk_fb m' proof (chain)
picking this:
untyped_mdb' m proof (prove)
using this:
untyped_mdb' m

goal (1 subgoal):
 1. untyped_mdb' m' proof (prove)
goal (1 subgoal):
 1. \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> p' \<in> descendants_of' p m) \<Longrightarrow> \<forall>p p' c. (\<exists>n. m' p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m' p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> p' \<in> descendants_of' p m') proof (prove)
goal (1 subgoal):
 1. \<And>p p' c n c' n'. \<lbrakk>\<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> p' \<in> descendants_of' p m); m' p = Some (CTE c n); isUntypedCap c; m' p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}\<rbrakk> \<Longrightarrow> p' \<in> descendants_of' p m' proof (prove)
goal (1 subgoal):
 1. \<And>p p' c n c' n'. \<lbrakk>\<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> p' \<in> descendants_of' p m); isUntypedCap c; \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; if p = src then c = capability.NullCap else if p = dest then c = cap' else \<exists>node'. m p = Some (CTE c node'); if p' = src then c' = capability.NullCap else if p' = dest then c' = cap' else \<exists>node'. m p' = Some (CTE c' node')\<rbrakk> \<Longrightarrow> p' \<in> descendants_of' p m' proof (prove)
goal (2 subgoals):
 1. \<And>p' c' node'. \<lbrakk>\<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> p' \<in> descendants_of' p m); isUntypedCap cap'; \<not> isUntypedCap c'; capRange c' \<inter> untypedRange cap' \<noteq> {}; p' \<noteq> src; p' \<noteq> dest; m p' = Some (CTE c' node')\<rbrakk> \<Longrightarrow> p' \<in> descendants_of' src m
 2. \<And>p c node'. \<lbrakk>\<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> p' \<in> descendants_of' p m); isUntypedCap c; \<not> isUntypedCap cap'; capRange cap' \<inter> untypedRange c \<noteq> {}; p \<noteq> src; p \<noteq> dest; m p = Some (CTE c node'); src \<notin> descendants_of' p m\<rbrakk> \<Longrightarrow> dest \<in> descendants_of' p m proof (prove)
goal (2 subgoals):
 1. \<And>p' c' node'. \<lbrakk>isUntypedCap cap'; \<not> isUntypedCap c'; capRange c' \<inter> untypedRange cap' \<noteq> {}; p' \<noteq> src; p' \<noteq> dest; m p' = Some (CTE c' node'); \<forall>p' c. (\<exists>n. m src = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> p' \<in> descendants_of' src m)\<rbrakk> \<Longrightarrow> p' \<in> descendants_of' src m
 2. \<And>p c node'. \<lbrakk>\<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> p' \<in> descendants_of' p m); isUntypedCap c; \<not> isUntypedCap cap'; capRange cap' \<inter> untypedRange c \<noteq> {}; p \<noteq> src; p \<noteq> dest; m p = Some (CTE c node'); src \<notin> descendants_of' p m\<rbrakk> \<Longrightarrow> dest \<in> descendants_of' p m proof (prove)
goal (2 subgoals):
 1. \<And>p' c' node'. \<lbrakk>isUntypedCap cap'; \<not> isUntypedCap c'; capRange c' \<inter> untypedRange cap' \<noteq> {}; p' \<noteq> src; p' \<noteq> dest; m p' = Some (CTE c' node'); \<forall>c. (\<exists>n. m src = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> p' \<in> descendants_of' src m)\<rbrakk> \<Longrightarrow> p' \<in> descendants_of' src m
 2. \<And>p c node'. \<lbrakk>\<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> p' \<in> descendants_of' p m); isUntypedCap c; \<not> isUntypedCap cap'; capRange cap' \<inter> untypedRange c \<noteq> {}; p \<noteq> src; p \<noteq> dest; m p = Some (CTE c node'); src \<notin> descendants_of' p m\<rbrakk> \<Longrightarrow> dest \<in> descendants_of' p m proof (prove)
goal (1 subgoal):
 1. \<And>p c node'. \<lbrakk>\<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> p' \<in> descendants_of' p m); isUntypedCap c; \<not> isUntypedCap cap'; capRange cap' \<inter> untypedRange c \<noteq> {}; p \<noteq> src; p \<noteq> dest; m p = Some (CTE c node'); src \<notin> descendants_of' p m\<rbrakk> \<Longrightarrow> dest \<in> descendants_of' p m proof (prove)
goal (1 subgoal):
 1. \<And>p c node'. \<lbrakk>isUntypedCap c; \<not> isUntypedCap cap'; capRange cap' \<inter> untypedRange c \<noteq> {}; p \<noteq> src; p \<noteq> dest; m p = Some (CTE c node'); src \<notin> descendants_of' p m; \<forall>p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> p' \<in> descendants_of' p m)\<rbrakk> \<Longrightarrow> dest \<in> descendants_of' p m proof (prove)
goal (1 subgoal):
 1. \<And>p c node'. \<lbrakk>isUntypedCap c; \<not> isUntypedCap cap'; capRange cap' \<inter> untypedRange c \<noteq> {}; p \<noteq> src; p \<noteq> dest; m p = Some (CTE c node'); src \<notin> descendants_of' p m; \<forall>c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m src = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> src \<in> descendants_of' p m)\<rbrakk> \<Longrightarrow> dest \<in> descendants_of' p m proof (prove)
goal:
No subgoals! proof (state)
this:
untyped_mdb' m'

goal (7 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> irq_control m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> reply_masters_rvk_fb m' proof (state)
this:
isUntypedCap cap' \<Longrightarrow> cap' = src_cap

goal (7 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> untyped_inc' m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> irq_control m'
 7. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> reply_masters_rvk_fb m' proof (chain)
picking this:
untyped_inc' m proof (prove)
using this:
untyped_inc' m

goal (1 subgoal):
 1. untyped_inc' m' proof (prove)
using this:
untyped_inc' m
isUntypedCap cap' \<Longrightarrow> cap' = src_cap

goal (1 subgoal):
 1. untyped_inc' m' proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap cap' \<Longrightarrow> cap' = src_cap\<rbrakk> \<Longrightarrow> \<forall>p p' c. (\<exists>n. m' p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m' p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m' \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m' \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m' \<and> usableUntypedRange c' = {} \<or> p = p')) proof (prove)
goal (1 subgoal):
 1. \<And>p p' c n c' n'. \<lbrakk>\<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap cap' \<Longrightarrow> cap' = src_cap; m' p = Some (CTE c n); isUntypedCap c; m' p' = Some (CTE c' n'); isUntypedCap c'\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m' \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m' \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m' \<and> usableUntypedRange c' = {} \<or> p = p') proof (prove)
goal (1 subgoal):
 1. \<And>p p' c n c' n'. \<lbrakk>\<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap cap' \<Longrightarrow> cap' = src_cap; isUntypedCap c; isUntypedCap c'; if p = src then c = capability.NullCap else if p = dest then c = cap' else \<exists>node'. m p = Some (CTE c node'); if p' = src then c' = capability.NullCap else if p' = dest then c' = cap' else \<exists>node'. m p' = Some (CTE c' node')\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m' \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m' \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m' \<and> usableUntypedRange c' = {} \<or> p = p') proof (prove)
goal (3 subgoals):
 1. \<And>p' c' node'. \<lbrakk>\<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); cap' = src_cap; isUntypedCap src_cap; isUntypedCap c'; p' \<noteq> src; p' \<noteq> dest; m p' = Some (CTE c' node')\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> (untypedRange src_cap \<subset> untypedRange c' \<longrightarrow> untypedRange src_cap \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange src_cap \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c' \<inter> usableUntypedRange src_cap = {}) \<and> (untypedRange src_cap = untypedRange c' \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange src_cap = {} \<or> usableUntypedRange c' = {})) \<and> (src \<notin> descendants_of' p' m \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> (untypedRange src_cap \<subset> untypedRange c' \<longrightarrow> dest \<in> descendants_of' p' m \<and> untypedRange src_cap \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange src_cap \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c' \<inter> usableUntypedRange src_cap = {}) \<and> (untypedRange src_cap = untypedRange c' \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange src_cap = {} \<or> dest \<in> descendants_of' p' m \<and> usableUntypedRange c' = {}))
 2. \<And>p c node'. \<lbrakk>\<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); cap' = src_cap; isUntypedCap c; isUntypedCap src_cap; p \<noteq> src; p \<noteq> dest; m p = Some (CTE c node')\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> (untypedRange c \<subset> untypedRange src_cap \<longrightarrow> p \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange src_cap = {}) \<and> (untypedRange src_cap \<subset> untypedRange c \<longrightarrow> untypedRange src_cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {} \<or> p \<in> descendants_of' src m \<and> usableUntypedRange src_cap = {})) \<and> (src \<notin> descendants_of' p m \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> (untypedRange c \<subset> untypedRange src_cap \<longrightarrow> p \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange src_cap = {}) \<and> (untypedRange src_cap \<subset> untypedRange c \<longrightarrow> dest \<in> descendants_of' p m \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> dest \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' src m \<and> usableUntypedRange src_cap = {}))
 3. \<And>p p' c c' node' node'a. \<lbrakk>\<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap cap' \<Longrightarrow> cap' = src_cap; isUntypedCap c; isUntypedCap c'; p \<noteq> src; p \<noteq> dest; p' \<noteq> src; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a)\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) proof (prove)
goal (3 subgoals):
 1. \<And>p' c' node'. \<lbrakk>cap' = src_cap; isUntypedCap src_cap; isUntypedCap c'; p' \<noteq> src; p' \<noteq> dest; m p' = Some (CTE c' node'); \<forall>p' c. (\<exists>n. m src = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> src \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> src = p'))\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> (untypedRange src_cap \<subset> untypedRange c' \<longrightarrow> untypedRange src_cap \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange src_cap \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c' \<inter> usableUntypedRange src_cap = {}) \<and> (untypedRange src_cap = untypedRange c' \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange src_cap = {} \<or> usableUntypedRange c' = {})) \<and> (src \<notin> descendants_of' p' m \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> (untypedRange src_cap \<subset> untypedRange c' \<longrightarrow> dest \<in> descendants_of' p' m \<and> untypedRange src_cap \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange src_cap \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c' \<inter> usableUntypedRange src_cap = {}) \<and> (untypedRange src_cap = untypedRange c' \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange src_cap = {} \<or> dest \<in> descendants_of' p' m \<and> usableUntypedRange c' = {}))
 2. \<And>p c node'. \<lbrakk>\<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); cap' = src_cap; isUntypedCap c; isUntypedCap src_cap; p \<noteq> src; p \<noteq> dest; m p = Some (CTE c node')\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> (untypedRange c \<subset> untypedRange src_cap \<longrightarrow> p \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange src_cap = {}) \<and> (untypedRange src_cap \<subset> untypedRange c \<longrightarrow> untypedRange src_cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {} \<or> p \<in> descendants_of' src m \<and> usableUntypedRange src_cap = {})) \<and> (src \<notin> descendants_of' p m \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> (untypedRange c \<subset> untypedRange src_cap \<longrightarrow> p \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange src_cap = {}) \<and> (untypedRange src_cap \<subset> untypedRange c \<longrightarrow> dest \<in> descendants_of' p m \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> dest \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' src m \<and> usableUntypedRange src_cap = {}))
 3. \<And>p p' c c' node' node'a. \<lbrakk>\<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap cap' \<Longrightarrow> cap' = src_cap; isUntypedCap c; isUntypedCap c'; p \<noteq> src; p \<noteq> dest; p' \<noteq> src; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a)\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) proof (prove)
goal (3 subgoals):
 1. \<And>p' c' node'. \<lbrakk>cap' = src_cap; isUntypedCap src_cap; isUntypedCap c'; p' \<noteq> src; p' \<noteq> dest; m p' = Some (CTE c' node'); \<forall>c. (\<exists>n. m src = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> src \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> src = p'))\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> (untypedRange src_cap \<subset> untypedRange c' \<longrightarrow> untypedRange src_cap \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange src_cap \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c' \<inter> usableUntypedRange src_cap = {}) \<and> (untypedRange src_cap = untypedRange c' \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange src_cap = {} \<or> usableUntypedRange c' = {})) \<and> (src \<notin> descendants_of' p' m \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> (untypedRange src_cap \<subset> untypedRange c' \<longrightarrow> dest \<in> descendants_of' p' m \<and> untypedRange src_cap \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange src_cap \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c' \<inter> usableUntypedRange src_cap = {}) \<and> (untypedRange src_cap = untypedRange c' \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange src_cap = {} \<or> dest \<in> descendants_of' p' m \<and> usableUntypedRange c' = {}))
 2. \<And>p c node'. \<lbrakk>\<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); cap' = src_cap; isUntypedCap c; isUntypedCap src_cap; p \<noteq> src; p \<noteq> dest; m p = Some (CTE c node')\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> (untypedRange c \<subset> untypedRange src_cap \<longrightarrow> p \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange src_cap = {}) \<and> (untypedRange src_cap \<subset> untypedRange c \<longrightarrow> untypedRange src_cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {} \<or> p \<in> descendants_of' src m \<and> usableUntypedRange src_cap = {})) \<and> (src \<notin> descendants_of' p m \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> (untypedRange c \<subset> untypedRange src_cap \<longrightarrow> p \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange src_cap = {}) \<and> (untypedRange src_cap \<subset> untypedRange c \<longrightarrow> dest \<in> descendants_of' p m \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> dest \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' src m \<and> usableUntypedRange src_cap = {}))
 3. \<And>p p' c c' node' node'a. \<lbrakk>\<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap cap' \<Longrightarrow> cap' = src_cap; isUntypedCap c; isUntypedCap c'; p \<noteq> src; p \<noteq> dest; p' \<noteq> src; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a)\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) proof (prove)
goal (3 subgoals):
 1. \<And>p' c' node'. \<lbrakk>cap' = src_cap; isUntypedCap src_cap; isUntypedCap c'; p' \<noteq> src; p' \<noteq> dest; m p' = Some (CTE c' node'); untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}; untypedRange src_cap \<subset> untypedRange c' \<longrightarrow> src \<in> descendants_of' p' m \<and> untypedRange src_cap \<inter> usableUntypedRange c' = {}; untypedRange c' \<subset> untypedRange src_cap \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c' \<inter> usableUntypedRange src_cap = {}; untypedRange src_cap = untypedRange c' \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange src_cap = {} \<or> src \<in> descendants_of' p' m \<and> usableUntypedRange c' = {}\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> untypedRange src_cap = untypedRange c' \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange src_cap = {} \<or> usableUntypedRange c' = {}) \<and> (src \<notin> descendants_of' p' m \<longrightarrow> (untypedRange src_cap \<subset> untypedRange c' \<longrightarrow> dest \<in> descendants_of' p' m) \<and> (untypedRange src_cap = untypedRange c' \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange src_cap = {} \<or> dest \<in> descendants_of' p' m \<and> usableUntypedRange c' = {}))
 2. \<And>p c node'. \<lbrakk>\<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); cap' = src_cap; isUntypedCap c; isUntypedCap src_cap; p \<noteq> src; p \<noteq> dest; m p = Some (CTE c node')\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> (untypedRange c \<subset> untypedRange src_cap \<longrightarrow> p \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange src_cap = {}) \<and> (untypedRange src_cap \<subset> untypedRange c \<longrightarrow> untypedRange src_cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {} \<or> p \<in> descendants_of' src m \<and> usableUntypedRange src_cap = {})) \<and> (src \<notin> descendants_of' p m \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> (untypedRange c \<subset> untypedRange src_cap \<longrightarrow> p \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange src_cap = {}) \<and> (untypedRange src_cap \<subset> untypedRange c \<longrightarrow> dest \<in> descendants_of' p m \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> dest \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' src m \<and> usableUntypedRange src_cap = {}))
 3. \<And>p p' c c' node' node'a. \<lbrakk>\<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap cap' \<Longrightarrow> cap' = src_cap; isUntypedCap c; isUntypedCap c'; p \<noteq> src; p \<noteq> dest; p' \<noteq> src; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a)\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) proof (prove)
goal (5 subgoals):
 1. \<And>p' c' node'. \<lbrakk>cap' = src_cap; isUntypedCap src_cap; isUntypedCap c'; p' \<noteq> src; p' \<noteq> dest; m p' = Some (CTE c' node'); untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}; untypedRange src_cap \<subset> untypedRange c' \<longrightarrow> src \<in> descendants_of' p' m \<and> untypedRange src_cap \<inter> usableUntypedRange c' = {}; untypedRange c' \<subset> untypedRange src_cap \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c' \<inter> usableUntypedRange src_cap = {}; untypedRange src_cap = untypedRange c' \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange src_cap = {} \<or> src \<in> descendants_of' p' m \<and> usableUntypedRange c' = {}; src \<in> descendants_of' p' m; untypedRange src_cap = untypedRange c'\<rbrakk> \<Longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange src_cap = {} \<or> usableUntypedRange c' = {}
 2. \<And>p' c' node'. \<lbrakk>cap' = src_cap; isUntypedCap src_cap; isUntypedCap c'; p' \<noteq> src; p' \<noteq> dest; m p' = Some (CTE c' node'); untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}; untypedRange src_cap \<subset> untypedRange c' \<longrightarrow> src \<in> descendants_of' p' m \<and> untypedRange src_cap \<inter> usableUntypedRange c' = {}; untypedRange c' \<subset> untypedRange src_cap \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c' \<inter> usableUntypedRange src_cap = {}; untypedRange src_cap = untypedRange c' \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange src_cap = {} \<or> src \<in> descendants_of' p' m \<and> usableUntypedRange c' = {}; src \<notin> descendants_of' p' m; untypedRange src_cap \<subset> untypedRange c'\<rbrakk> \<Longrightarrow> dest \<in> descendants_of' p' m
 3. \<And>p' c' node'. \<lbrakk>cap' = src_cap; isUntypedCap src_cap; isUntypedCap c'; p' \<noteq> src; p' \<noteq> dest; m p' = Some (CTE c' node'); untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}; untypedRange src_cap \<subset> untypedRange c' \<longrightarrow> src \<in> descendants_of' p' m \<and> untypedRange src_cap \<inter> usableUntypedRange c' = {}; untypedRange c' \<subset> untypedRange src_cap \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c' \<inter> usableUntypedRange src_cap = {}; untypedRange src_cap = untypedRange c' \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange src_cap = {} \<or> src \<in> descendants_of' p' m \<and> usableUntypedRange c' = {}; src \<notin> descendants_of' p' m; untypedRange src_cap = untypedRange c'\<rbrakk> \<Longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange src_cap = {} \<or> dest \<in> descendants_of' p' m \<and> usableUntypedRange c' = {}
 4. \<And>p c node'. \<lbrakk>\<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); cap' = src_cap; isUntypedCap c; isUntypedCap src_cap; p \<noteq> src; p \<noteq> dest; m p = Some (CTE c node')\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> (untypedRange c \<subset> untypedRange src_cap \<longrightarrow> p \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange src_cap = {}) \<and> (untypedRange src_cap \<subset> untypedRange c \<longrightarrow> untypedRange src_cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {} \<or> p \<in> descendants_of' src m \<and> usableUntypedRange src_cap = {})) \<and> (src \<notin> descendants_of' p m \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> (untypedRange c \<subset> untypedRange src_cap \<longrightarrow> p \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange src_cap = {}) \<and> (untypedRange src_cap \<subset> untypedRange c \<longrightarrow> dest \<in> descendants_of' p m \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> dest \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' src m \<and> usableUntypedRange src_cap = {}))
 5. \<And>p p' c c' node' node'a. \<lbrakk>\<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap cap' \<Longrightarrow> cap' = src_cap; isUntypedCap c; isUntypedCap c'; p \<noteq> src; p \<noteq> dest; p' \<noteq> src; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a)\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) proof (prove)
goal (2 subgoals):
 1. \<And>p c node'. \<lbrakk>\<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); cap' = src_cap; isUntypedCap c; isUntypedCap src_cap; p \<noteq> src; p \<noteq> dest; m p = Some (CTE c node')\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> (untypedRange c \<subset> untypedRange src_cap \<longrightarrow> p \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange src_cap = {}) \<and> (untypedRange src_cap \<subset> untypedRange c \<longrightarrow> untypedRange src_cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {} \<or> p \<in> descendants_of' src m \<and> usableUntypedRange src_cap = {})) \<and> (src \<notin> descendants_of' p m \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> (untypedRange c \<subset> untypedRange src_cap \<longrightarrow> p \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange src_cap = {}) \<and> (untypedRange src_cap \<subset> untypedRange c \<longrightarrow> dest \<in> descendants_of' p m \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> dest \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' src m \<and> usableUntypedRange src_cap = {}))
 2. \<And>p p' c c' node' node'a. \<lbrakk>\<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap cap' \<Longrightarrow> cap' = src_cap; isUntypedCap c; isUntypedCap c'; p \<noteq> src; p \<noteq> dest; p' \<noteq> src; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a)\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) proof (prove)
goal (2 subgoals):
 1. \<And>p c node'. \<lbrakk>cap' = src_cap; isUntypedCap c; isUntypedCap src_cap; p \<noteq> src; p \<noteq> dest; m p = Some (CTE c node'); \<forall>p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p'))\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> (untypedRange c \<subset> untypedRange src_cap \<longrightarrow> p \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange src_cap = {}) \<and> (untypedRange src_cap \<subset> untypedRange c \<longrightarrow> untypedRange src_cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {} \<or> p \<in> descendants_of' src m \<and> usableUntypedRange src_cap = {})) \<and> (src \<notin> descendants_of' p m \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> (untypedRange c \<subset> untypedRange src_cap \<longrightarrow> p \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange src_cap = {}) \<and> (untypedRange src_cap \<subset> untypedRange c \<longrightarrow> dest \<in> descendants_of' p m \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> dest \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' src m \<and> usableUntypedRange src_cap = {}))
 2. \<And>p p' c c' node' node'a. \<lbrakk>\<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap cap' \<Longrightarrow> cap' = src_cap; isUntypedCap c; isUntypedCap c'; p \<noteq> src; p \<noteq> dest; p' \<noteq> src; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a)\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) proof (prove)
goal (2 subgoals):
 1. \<And>p c node'. \<lbrakk>cap' = src_cap; isUntypedCap c; isUntypedCap src_cap; p \<noteq> src; p \<noteq> dest; m p = Some (CTE c node'); \<forall>c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m src = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> src \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' src m \<and> usableUntypedRange c' = {} \<or> p = src))\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> (untypedRange c \<subset> untypedRange src_cap \<longrightarrow> p \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange src_cap = {}) \<and> (untypedRange src_cap \<subset> untypedRange c \<longrightarrow> untypedRange src_cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {} \<or> p \<in> descendants_of' src m \<and> usableUntypedRange src_cap = {})) \<and> (src \<notin> descendants_of' p m \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> (untypedRange c \<subset> untypedRange src_cap \<longrightarrow> p \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange src_cap = {}) \<and> (untypedRange src_cap \<subset> untypedRange c \<longrightarrow> dest \<in> descendants_of' p m \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> dest \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' src m \<and> usableUntypedRange src_cap = {}))
 2. \<And>p p' c c' node' node'a. \<lbrakk>\<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap cap' \<Longrightarrow> cap' = src_cap; isUntypedCap c; isUntypedCap c'; p \<noteq> src; p \<noteq> dest; p' \<noteq> src; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a)\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) proof (prove)
goal (2 subgoals):
 1. \<And>p c node'. \<lbrakk>cap' = src_cap; isUntypedCap c; isUntypedCap src_cap; p \<noteq> src; p \<noteq> dest; m p = Some (CTE c node'); untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}; untypedRange c \<subset> untypedRange src_cap \<longrightarrow> p \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange src_cap = {}; untypedRange src_cap \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' p m \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange src_cap \<longrightarrow> src \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' src m \<and> usableUntypedRange src_cap = {}\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {} \<or> p \<in> descendants_of' src m \<and> usableUntypedRange src_cap = {}) \<and> (src \<notin> descendants_of' p m \<longrightarrow> (untypedRange src_cap \<subset> untypedRange c \<longrightarrow> dest \<in> descendants_of' p m) \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> dest \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' src m \<and> usableUntypedRange src_cap = {}))
 2. \<And>p p' c c' node' node'a. \<lbrakk>\<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap cap' \<Longrightarrow> cap' = src_cap; isUntypedCap c; isUntypedCap c'; p \<noteq> src; p \<noteq> dest; p' \<noteq> src; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a)\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) proof (prove)
goal (4 subgoals):
 1. \<And>p c node'. \<lbrakk>cap' = src_cap; isUntypedCap c; isUntypedCap src_cap; p \<noteq> src; p \<noteq> dest; m p = Some (CTE c node'); untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}; untypedRange c \<subset> untypedRange src_cap \<longrightarrow> p \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange src_cap = {}; untypedRange src_cap \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' p m \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange src_cap \<longrightarrow> src \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' src m \<and> usableUntypedRange src_cap = {}; src \<in> descendants_of' p m; untypedRange c = untypedRange src_cap\<rbrakk> \<Longrightarrow> usableUntypedRange c = {} \<or> p \<in> descendants_of' src m \<and> usableUntypedRange src_cap = {}
 2. \<And>p c node'. \<lbrakk>cap' = src_cap; isUntypedCap c; isUntypedCap src_cap; p \<noteq> src; p \<noteq> dest; m p = Some (CTE c node'); untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}; untypedRange c \<subset> untypedRange src_cap \<longrightarrow> p \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange src_cap = {}; untypedRange src_cap \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' p m \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange src_cap \<longrightarrow> src \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' src m \<and> usableUntypedRange src_cap = {}; src \<notin> descendants_of' p m; untypedRange src_cap \<subset> untypedRange c\<rbrakk> \<Longrightarrow> dest \<in> descendants_of' p m
 3. \<And>p c node'. \<lbrakk>cap' = src_cap; isUntypedCap c; isUntypedCap src_cap; p \<noteq> src; p \<noteq> dest; m p = Some (CTE c node'); untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}; untypedRange c \<subset> untypedRange src_cap \<longrightarrow> p \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange src_cap = {}; untypedRange src_cap \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' p m \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange src_cap \<longrightarrow> src \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' src m \<and> usableUntypedRange src_cap = {}; src \<notin> descendants_of' p m; untypedRange c = untypedRange src_cap\<rbrakk> \<Longrightarrow> dest \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' src m \<and> usableUntypedRange src_cap = {}
 4. \<And>p p' c c' node' node'a. \<lbrakk>\<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap cap' \<Longrightarrow> cap' = src_cap; isUntypedCap c; isUntypedCap c'; p \<noteq> src; p \<noteq> dest; p' \<noteq> src; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a)\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) proof (prove)
goal (1 subgoal):
 1. \<And>p p' c c' node' node'a. \<lbrakk>\<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap cap' \<Longrightarrow> cap' = src_cap; isUntypedCap c; isUntypedCap c'; p \<noteq> src; p \<noteq> dest; p' \<noteq> src; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a)\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) proof (prove)
goal (1 subgoal):
 1. \<And>p p' c c' node' node'a. \<lbrakk>isUntypedCap cap' \<Longrightarrow> cap' = src_cap; isUntypedCap c; isUntypedCap c'; p \<noteq> src; p \<noteq> dest; p' \<noteq> src; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a); \<forall>p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p'))\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) proof (prove)
goal (1 subgoal):
 1. \<And>p p' c c' node' node'a. \<lbrakk>isUntypedCap cap' \<Longrightarrow> cap' = src_cap; isUntypedCap c; isUntypedCap c'; p \<noteq> src; p \<noteq> dest; p' \<noteq> src; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a); \<forall>c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p'))\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) proof (prove)
goal:
No subgoals! proof (state)
this:
untyped_inc' m'

goal (6 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> irq_control m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> reply_masters_rvk_fb m' proof (state)
this:
\<lbrakk>?b = ?c; ?c \<Longrightarrow> ?x = ?u; \<not> ?c \<Longrightarrow> ?y = ?v\<rbrakk> \<Longrightarrow> (if ?b then ?x else ?y) = (if ?c then ?u else ?v)

goal (6 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> irq_control m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> reply_masters_rvk_fb m' proof (chain)
picking this:
src_cap \<noteq> capability.NullCap
weak_derived' src_cap cap' proof (prove)
using this:
src_cap \<noteq> capability.NullCap
weak_derived' src_cap cap'

goal (1 subgoal):
 1. src_cap \<noteq> capability.NullCap \<and> cap' \<noteq> capability.NullCap proof (state)
this:
src_cap \<noteq> capability.NullCap \<and> cap' \<noteq> capability.NullCap

goal (6 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> irq_control m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> reply_masters_rvk_fb m' proof (state)
this:
src_cap \<noteq> capability.NullCap \<and> cap' \<noteq> capability.NullCap

goal (6 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> irq_control m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> reply_masters_rvk_fb m' proof (chain)
picking this:
valid_mdb_ctes m proof (prove)
using this:
valid_mdb_ctes m

goal (1 subgoal):
 1. valid_nullcaps m proof (state)
this:
valid_nullcaps m

goal (6 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> valid_nullcaps m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> irq_control m'
 6. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> reply_masters_rvk_fb m' proof (chain)
picking this:
src_cap \<noteq> capability.NullCap \<and> cap' \<noteq> capability.NullCap
valid_nullcaps m proof (prove)
using this:
src_cap \<noteq> capability.NullCap \<and> cap' \<noteq> capability.NullCap
valid_nullcaps m

goal (1 subgoal):
 1. valid_nullcaps m' proof (prove)
goal (1 subgoal):
 1. \<And>p n. \<lbrakk>\<forall>p n. m p = Some (CTE capability.NullCap n) \<longrightarrow> n = nullMDBNode; src_cap \<noteq> capability.NullCap; cap' \<noteq> capability.NullCap; m' p = Some (CTE capability.NullCap n)\<rbrakk> \<Longrightarrow> n = nullMDBNode proof (prove)
goal (1 subgoal):
 1. \<And>p n. \<lbrakk>\<forall>p n. m p = Some (CTE capability.NullCap n) \<longrightarrow> n = nullMDBNode; src_cap \<noteq> capability.NullCap; cap' \<noteq> capability.NullCap; m' p = Some (CTE capability.NullCap n); if p = src then capability.NullCap = capability.NullCap else if p = dest then capability.NullCap = cap' else \<exists>node'. m p = Some (CTE capability.NullCap node')\<rbrakk> \<Longrightarrow> n = nullMDBNode proof (prove)
goal (1 subgoal):
 1. \<And>p n. \<lbrakk>\<forall>p n. m p = Some (CTE capability.NullCap n) \<longrightarrow> n = nullMDBNode; src_cap \<noteq> capability.NullCap; cap' \<noteq> capability.NullCap; m' p = Some (CTE capability.NullCap n); if p = src then capability.NullCap = capability.NullCap else if p = dest then capability.NullCap = cap' else \<exists>node'. m p = Some (CTE capability.NullCap node'); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node)\<rbrakk> \<Longrightarrow> n = nullMDBNode proof (prove)
goal (1 subgoal):
 1. \<And>p n. \<lbrakk>\<forall>p n. m p = Some (CTE capability.NullCap n) \<longrightarrow> n = nullMDBNode; src_cap \<noteq> capability.NullCap; cap' \<noteq> capability.NullCap; m' p = Some (CTE capability.NullCap n); if p = src then capability.NullCap = capability.NullCap else if p = dest then capability.NullCap = cap' else \<exists>node'. m p = Some (CTE capability.NullCap node'); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); old_dest_node = nullMDBNode\<rbrakk> \<Longrightarrow> n = nullMDBNode proof (prove)
goal (2 subgoals):
 1. \<And>n. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap nullMDBNode); old_dest_node = nullMDBNode; \<forall>p n. m p = Some (CTE capability.NullCap n) \<longrightarrow> n = nullMDBNode; src_cap \<noteq> capability.NullCap; cap' \<noteq> capability.NullCap; m' src = Some (CTE capability.NullCap n)\<rbrakk> \<Longrightarrow> n = nullMDBNode
 2. \<And>p n node'. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap nullMDBNode); old_dest_node = nullMDBNode; \<forall>p n. m p = Some (CTE capability.NullCap n) \<longrightarrow> n = nullMDBNode; src_cap \<noteq> capability.NullCap; cap' \<noteq> capability.NullCap; m' p = Some (CTE capability.NullCap n); p \<noteq> src; p \<noteq> dest; m p = Some (CTE capability.NullCap node')\<rbrakk> \<Longrightarrow> n = nullMDBNode proof (prove)
goal (2 subgoals):
 1. \<And>n. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap nullMDBNode); old_dest_node = nullMDBNode; \<forall>p n. m p = Some (CTE capability.NullCap n) \<longrightarrow> n = nullMDBNode; src_cap \<noteq> capability.NullCap; cap' \<noteq> capability.NullCap; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map m dest (cteCap_update (\<lambda>_. cap'))) src (cteCap_update (\<lambda>_. capability.NullCap))) dest (cteMDBNode_update (\<lambda>m. src_node))) src (cteMDBNode_update (\<lambda>m. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) src = Some (CTE capability.NullCap n)\<rbrakk> \<Longrightarrow> n = nullMDBNode
 2. \<And>p n node'. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap nullMDBNode); old_dest_node = nullMDBNode; \<forall>p n. m p = Some (CTE capability.NullCap n) \<longrightarrow> n = nullMDBNode; src_cap \<noteq> capability.NullCap; cap' \<noteq> capability.NullCap; m' p = Some (CTE capability.NullCap n); p \<noteq> src; p \<noteq> dest; m p = Some (CTE capability.NullCap node')\<rbrakk> \<Longrightarrow> n = nullMDBNode proof (prove)
goal (1 subgoal):
 1. \<And>p n node'. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap nullMDBNode); old_dest_node = nullMDBNode; \<forall>p n. m p = Some (CTE capability.NullCap n) \<longrightarrow> n = nullMDBNode; src_cap \<noteq> capability.NullCap; cap' \<noteq> capability.NullCap; m' p = Some (CTE capability.NullCap n); p \<noteq> src; p \<noteq> dest; m p = Some (CTE capability.NullCap node')\<rbrakk> \<Longrightarrow> n = nullMDBNode proof (prove)
goal (1 subgoal):
 1. \<And>p n node'. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap nullMDBNode); old_dest_node = nullMDBNode; \<forall>p n. m p = Some (CTE capability.NullCap n) \<longrightarrow> n = nullMDBNode; src_cap \<noteq> capability.NullCap; cap' \<noteq> capability.NullCap; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map m dest (cteCap_update (\<lambda>_. cap'))) src (cteCap_update (\<lambda>_. capability.NullCap))) dest (cteMDBNode_update (\<lambda>m. src_node))) src (cteMDBNode_update (\<lambda>m. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE capability.NullCap n); p \<noteq> src; p \<noteq> dest; m p = Some (CTE capability.NullCap node')\<rbrakk> \<Longrightarrow> n = nullMDBNode proof (prove)
goal (1 subgoal):
 1. \<And>p n node'. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap nullMDBNode); old_dest_node = nullMDBNode; \<forall>p n. m p = Some (CTE capability.NullCap n) \<longrightarrow> n = nullMDBNode; src_cap \<noteq> capability.NullCap; cap' \<noteq> capability.NullCap; if mdbNext src_node = p then \<exists>node. (if mdbPrev src_node = p then mdbNext_update (\<lambda>_. dest) node' = node else node = node') \<and> mdbPrev_update (\<lambda>_. dest) node = n else if mdbPrev src_node = p then mdbNext_update (\<lambda>_. dest) node' = n else n = node'; p \<noteq> src; p \<noteq> dest; m p = Some (CTE capability.NullCap node')\<rbrakk> \<Longrightarrow> n = nullMDBNode proof (prove)
goal (2 subgoals):
 1. \<And>n node' node. \<lbrakk>m (mdbNext src_node) = Some (CTE capability.NullCap node'); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap nullMDBNode); old_dest_node = nullMDBNode; \<forall>p n. m p = Some (CTE capability.NullCap n) \<longrightarrow> n = nullMDBNode; src_cap \<noteq> capability.NullCap; cap' \<noteq> capability.NullCap; mdbPrev src_node = 0 \<and> mdbNext src_node = 0 \<longrightarrow> mdbNext_update (\<lambda>_. dest) node' = node \<and> mdbPrev_update (\<lambda>_. dest) node = n; mdbPrev src_node = 0 \<and> mdbNext src_node = 0 \<or> node = node' \<and> mdbPrev_update (\<lambda>_. dest) node' = n\<rbrakk> \<Longrightarrow> n = nullMDBNode
 2. \<And>node'. \<lbrakk>m (mdbPrev src_node) = Some (CTE capability.NullCap node'); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap nullMDBNode); old_dest_node = nullMDBNode; \<forall>p n. m p = Some (CTE capability.NullCap n) \<longrightarrow> n = nullMDBNode; src_cap \<noteq> capability.NullCap; cap' \<noteq> capability.NullCap; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> mdbNext_update (\<lambda>_. dest) node' = nullMDBNode proof (prove)
goal (3 subgoals):
 1. \<And>n node' node. \<lbrakk>m (mdbNext src_node) = Some (CTE capability.NullCap node'); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap nullMDBNode); old_dest_node = nullMDBNode; \<forall>p n. m p = Some (CTE capability.NullCap n) \<longrightarrow> n = nullMDBNode; src_cap \<noteq> capability.NullCap; cap' \<noteq> capability.NullCap; mdbPrev src_node = 0 \<and> mdbNext src_node = 0 \<longrightarrow> mdbNext_update (\<lambda>_. dest) node' = node \<and> mdbPrev_update (\<lambda>_. dest) node = n; mdbPrev src_node = 0 \<and> mdbNext src_node = 0\<rbrakk> \<Longrightarrow> n = nullMDBNode
 2. \<And>n node' node. \<lbrakk>m (mdbNext src_node) = Some (CTE capability.NullCap node'); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap nullMDBNode); old_dest_node = nullMDBNode; \<forall>p n. m p = Some (CTE capability.NullCap n) \<longrightarrow> n = nullMDBNode; src_cap \<noteq> capability.NullCap; cap' \<noteq> capability.NullCap; mdbPrev src_node = 0 \<and> mdbNext src_node = 0 \<longrightarrow> mdbNext_update (\<lambda>_. dest) node' = node \<and> mdbPrev_update (\<lambda>_. dest) node = n; node = node' \<and> mdbPrev_update (\<lambda>_. dest) node' = n\<rbrakk> \<Longrightarrow> n = nullMDBNode
 3. \<And>node'. \<lbrakk>m (mdbPrev src_node) = Some (CTE capability.NullCap node'); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap nullMDBNode); old_dest_node = nullMDBNode; \<forall>p n. m p = Some (CTE capability.NullCap n) \<longrightarrow> n = nullMDBNode; src_cap \<noteq> capability.NullCap; cap' \<noteq> capability.NullCap; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> mdbNext_update (\<lambda>_. dest) node' = nullMDBNode proof (prove)
goal (2 subgoals):
 1. \<And>n node' node. \<lbrakk>m (mdbNext src_node) = Some (CTE capability.NullCap node'); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap nullMDBNode); old_dest_node = nullMDBNode; \<forall>p n. m p = Some (CTE capability.NullCap n) \<longrightarrow> n = nullMDBNode; src_cap \<noteq> capability.NullCap; cap' \<noteq> capability.NullCap; mdbPrev src_node = 0 \<and> mdbNext src_node = 0 \<longrightarrow> mdbNext_update (\<lambda>_. dest) node' = node \<and> mdbPrev_update (\<lambda>_. dest) node = n; node = node' \<and> mdbPrev_update (\<lambda>_. dest) node' = n\<rbrakk> \<Longrightarrow> n = nullMDBNode
 2. \<And>node'. \<lbrakk>m (mdbPrev src_node) = Some (CTE capability.NullCap node'); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap nullMDBNode); old_dest_node = nullMDBNode; \<forall>p n. m p = Some (CTE capability.NullCap n) \<longrightarrow> n = nullMDBNode; src_cap \<noteq> capability.NullCap; cap' \<noteq> capability.NullCap; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> mdbNext_update (\<lambda>_. dest) node' = nullMDBNode proof (prove)
goal (2 subgoals):
 1. \<And>n node' node. \<lbrakk>m (mdbNext src_node) = Some (CTE capability.NullCap node'); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap nullMDBNode); old_dest_node = nullMDBNode; src_cap \<noteq> capability.NullCap; cap' \<noteq> capability.NullCap; mdbPrev src_node = 0 \<and> mdbNext src_node = 0 \<longrightarrow> mdbNext_update (\<lambda>_. dest) node' = node \<and> mdbPrev_update (\<lambda>_. dest) node = n; node = node' \<and> mdbPrev_update (\<lambda>_. dest) node' = n; node' = nullMDBNode\<rbrakk> \<Longrightarrow> n = nullMDBNode
 2. \<And>node'. \<lbrakk>m (mdbPrev src_node) = Some (CTE capability.NullCap node'); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap nullMDBNode); old_dest_node = nullMDBNode; \<forall>p n. m p = Some (CTE capability.NullCap n) \<longrightarrow> n = nullMDBNode; src_cap \<noteq> capability.NullCap; cap' \<noteq> capability.NullCap; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> mdbNext_update (\<lambda>_. dest) node' = nullMDBNode proof (prove)
goal (2 subgoals):
 1. \<lbrakk>m (mdbNext src_node) = Some (CTE capability.NullCap nullMDBNode); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap nullMDBNode); old_dest_node = nullMDBNode; src_cap \<noteq> capability.NullCap; cap' \<noteq> capability.NullCap; mdbPrev src_node = 0 \<and> mdbNext src_node = 0 \<longrightarrow> mdbNext_update (\<lambda>_. dest) nullMDBNode = nullMDBNode\<rbrakk> \<Longrightarrow> mdbPrev_update (\<lambda>_. dest) nullMDBNode = nullMDBNode
 2. \<And>node'. \<lbrakk>m (mdbPrev src_node) = Some (CTE capability.NullCap node'); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap nullMDBNode); old_dest_node = nullMDBNode; \<forall>p n. m p = Some (CTE capability.NullCap n) \<longrightarrow> n = nullMDBNode; src_cap \<noteq> capability.NullCap; cap' \<noteq> capability.NullCap; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> mdbNext_update (\<lambda>_. dest) node' = nullMDBNode proof (prove)
goal (2 subgoals):
 1. \<lbrakk>m (mdbNext src_node) = Some (CTE capability.NullCap nullMDBNode); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap nullMDBNode); old_dest_node = nullMDBNode; src_cap \<noteq> capability.NullCap; cap' \<noteq> capability.NullCap; mdbPrev src_node = 0 \<and> mdbNext src_node = 0 \<longrightarrow> mdbNext_update (\<lambda>_. dest) nullMDBNode = nullMDBNode; valid_dlist m\<rbrakk> \<Longrightarrow> mdbPrev_update (\<lambda>_. dest) nullMDBNode = nullMDBNode
 2. \<And>node'. \<lbrakk>m (mdbPrev src_node) = Some (CTE capability.NullCap node'); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap nullMDBNode); old_dest_node = nullMDBNode; \<forall>p n. m p = Some (CTE capability.NullCap n) \<longrightarrow> n = nullMDBNode; src_cap \<noteq> capability.NullCap; cap' \<noteq> capability.NullCap; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; valid_dlist m\<rbrakk> \<Longrightarrow> mdbNext_update (\<lambda>_. dest) node' = nullMDBNode proof (prove)
goal (3 subgoals):
 1. \<lbrakk>m (mdbNext src_node) = Some (CTE capability.NullCap nullMDBNode); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap nullMDBNode); old_dest_node = nullMDBNode; src_cap \<noteq> capability.NullCap; cap' \<noteq> capability.NullCap; mdbPrev src_node = 0 \<and> mdbNext src_node = 0 \<longrightarrow> mdbNext_update (\<lambda>_. dest) nullMDBNode = nullMDBNode\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode (CTE src_cap src_node)) \<noteq> 0
 2. \<And>cte'. \<lbrakk>m (mdbNext src_node) = Some (CTE capability.NullCap nullMDBNode); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap nullMDBNode); old_dest_node = nullMDBNode; src_cap \<noteq> capability.NullCap; cap' \<noteq> capability.NullCap; mdbPrev src_node = 0 \<and> mdbNext src_node = 0 \<longrightarrow> mdbNext_update (\<lambda>_. dest) nullMDBNode = nullMDBNode; m (mdbNext (cteMDBNode (CTE src_cap src_node))) = Some cte'; mdbPrev (cteMDBNode cte') = src\<rbrakk> \<Longrightarrow> mdbPrev_update (\<lambda>_. dest) nullMDBNode = nullMDBNode
 3. \<And>node'. \<lbrakk>m (mdbPrev src_node) = Some (CTE capability.NullCap node'); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap nullMDBNode); old_dest_node = nullMDBNode; \<forall>p n. m p = Some (CTE capability.NullCap n) \<longrightarrow> n = nullMDBNode; src_cap \<noteq> capability.NullCap; cap' \<noteq> capability.NullCap; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; valid_dlist m\<rbrakk> \<Longrightarrow> mdbNext_update (\<lambda>_. dest) node' = nullMDBNode proof (prove)
goal (2 subgoals):
 1. \<And>cte'. \<lbrakk>m (mdbNext src_node) = Some (CTE capability.NullCap nullMDBNode); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap nullMDBNode); old_dest_node = nullMDBNode; src_cap \<noteq> capability.NullCap; cap' \<noteq> capability.NullCap; mdbPrev src_node = 0 \<and> mdbNext src_node = 0 \<longrightarrow> mdbNext_update (\<lambda>_. dest) nullMDBNode = nullMDBNode; m (mdbNext (cteMDBNode (CTE src_cap src_node))) = Some cte'; mdbPrev (cteMDBNode cte') = src\<rbrakk> \<Longrightarrow> mdbPrev_update (\<lambda>_. dest) nullMDBNode = nullMDBNode
 2. \<And>node'. \<lbrakk>m (mdbPrev src_node) = Some (CTE capability.NullCap node'); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap nullMDBNode); old_dest_node = nullMDBNode; \<forall>p n. m p = Some (CTE capability.NullCap n) \<longrightarrow> n = nullMDBNode; src_cap \<noteq> capability.NullCap; cap' \<noteq> capability.NullCap; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; valid_dlist m\<rbrakk> \<Longrightarrow> mdbNext_update (\<lambda>_. dest) node' = nullMDBNode proof (prove)
goal (1 subgoal):
 1. \<And>node'. \<lbrakk>m (mdbPrev src_node) = Some (CTE capability.NullCap node'); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap nullMDBNode); old_dest_node = nullMDBNode; \<forall>p n. m p = Some (CTE capability.NullCap n) \<longrightarrow> n = nullMDBNode; src_cap \<noteq> capability.NullCap; cap' \<noteq> capability.NullCap; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; valid_dlist m\<rbrakk> \<Longrightarrow> mdbNext_update (\<lambda>_. dest) node' = nullMDBNode proof (prove)
goal (1 subgoal):
 1. \<And>node'. \<lbrakk>m (mdbPrev src_node) = Some (CTE capability.NullCap node'); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap nullMDBNode); old_dest_node = nullMDBNode; src_cap \<noteq> capability.NullCap; cap' \<noteq> capability.NullCap; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; valid_dlist m; node' = nullMDBNode\<rbrakk> \<Longrightarrow> mdbNext_update (\<lambda>_. dest) node' = nullMDBNode proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m (mdbPrev src_node) = Some (CTE capability.NullCap nullMDBNode); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap nullMDBNode); old_dest_node = nullMDBNode; src_cap \<noteq> capability.NullCap; cap' \<noteq> capability.NullCap; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; valid_dlist m\<rbrakk> \<Longrightarrow> mdbNext_update (\<lambda>_. dest) nullMDBNode = nullMDBNode proof (prove)
goal (2 subgoals):
 1. \<lbrakk>m (mdbPrev src_node) = Some (CTE capability.NullCap nullMDBNode); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap nullMDBNode); old_dest_node = nullMDBNode; src_cap \<noteq> capability.NullCap; cap' \<noteq> capability.NullCap; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> mdbPrev (cteMDBNode (CTE src_cap src_node)) \<noteq> 0
 2. \<And>cte'. \<lbrakk>m (mdbPrev src_node) = Some (CTE capability.NullCap nullMDBNode); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap nullMDBNode); old_dest_node = nullMDBNode; src_cap \<noteq> capability.NullCap; cap' \<noteq> capability.NullCap; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev (cteMDBNode (CTE src_cap src_node))) = Some cte'; mdbNext (cteMDBNode cte') = src\<rbrakk> \<Longrightarrow> mdbNext_update (\<lambda>_. dest) nullMDBNode = nullMDBNode proof (prove)
goal (1 subgoal):
 1. \<And>cte'. \<lbrakk>m (mdbPrev src_node) = Some (CTE capability.NullCap nullMDBNode); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap nullMDBNode); old_dest_node = nullMDBNode; src_cap \<noteq> capability.NullCap; cap' \<noteq> capability.NullCap; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev (cteMDBNode (CTE src_cap src_node))) = Some cte'; mdbNext (cteMDBNode cte') = src\<rbrakk> \<Longrightarrow> mdbNext_update (\<lambda>_. dest) nullMDBNode = nullMDBNode proof (prove)
goal:
No subgoals! proof (state)
this:
valid_nullcaps m'

goal (5 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> irq_control m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> reply_masters_rvk_fb m' proof (chain)
picking this:
valid_mdb_ctes m proof (prove)
using this:
valid_mdb_ctes m

goal (1 subgoal):
 1. ut_revocable' m proof (state)
this:
ut_revocable' m

goal (5 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> ut_revocable' m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> irq_control m'
 5. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> reply_masters_rvk_fb m' proof (prove)
using this:
ut_revocable' m

goal (1 subgoal):
 1. ut_revocable' m' proof (prove)
using this:
ut_revocable' m
m src = Some (CTE src_cap src_node)
m dest = Some (CTE capability.NullCap old_dest_node)
weak_derived' src_cap cap'

goal (1 subgoal):
 1. ut_revocable' m' proof (prove)
goal (1 subgoal):
 1. \<And>p cap n. \<lbrakk>\<forall>p cap n. m p = Some (CTE cap n) \<longrightarrow> isUntypedCap cap \<longrightarrow> mdbRevocable n; m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); weak_derived' src_cap cap'; m' p = Some (CTE cap n); isUntypedCap cap\<rbrakk> \<Longrightarrow> mdbRevocable n proof (prove)
goal (1 subgoal):
 1. \<And>p cap n. \<lbrakk>\<forall>p cap n. m p = Some (CTE cap n) \<longrightarrow> isUntypedCap cap \<longrightarrow> mdbRevocable n; m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); weak_derived' src_cap cap'; m' p = Some (CTE cap n); isUntypedCap cap; if p = src then cap = capability.NullCap else if p = dest then cap = cap' else \<exists>node'. m p = Some (CTE cap node')\<rbrakk> \<Longrightarrow> mdbRevocable n proof (prove)
goal (1 subgoal):
 1. \<And>p cap n. \<lbrakk>\<forall>p cap n. m p = Some (CTE cap n) \<longrightarrow> isUntypedCap cap \<longrightarrow> mdbRevocable n; m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); weak_derived' src_cap cap'; m' p = Some (CTE cap n); isUntypedCap cap; if p = src then cap = capability.NullCap else if p = dest then cap = cap' else \<exists>node'. m p = Some (CTE cap node'); if p = src then \<not> mdbRevocable n else if p = dest then mdbRevocable n = mdbRevocable src_node else \<exists>node'. m p = Some (CTE cap node') \<and> mdbRevocable n = mdbRevocable node'\<rbrakk> \<Longrightarrow> mdbRevocable n proof (prove)
goal (1 subgoal):
 1. \<And>n. \<lbrakk>\<forall>p cap n. m p = Some (CTE cap n) \<longrightarrow> isUntypedCap cap \<longrightarrow> mdbRevocable n; m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); weak_derived' src_cap cap'; m' dest = Some (CTE cap' n); isUntypedCap cap'; \<not> mdbRevocable n; \<not> mdbRevocable src_node\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>n. \<lbrakk>\<forall>p cap n. m p = Some (CTE cap n) \<longrightarrow> isUntypedCap cap \<longrightarrow> mdbRevocable n; m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); weak_derived' src_cap cap'; m' dest = Some (CTE cap' n); isUntypedCap cap'; \<not> mdbRevocable n; \<not> mdbRevocable src_node; isUntypedCap src_cap\<rbrakk> \<Longrightarrow> False
 2. \<And>n. \<lbrakk>\<forall>p cap n. m p = Some (CTE cap n) \<longrightarrow> isUntypedCap cap \<longrightarrow> mdbRevocable n; m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); weak_derived' src_cap cap'; m' dest = Some (CTE cap' n); isUntypedCap cap'; \<not> mdbRevocable n; \<not> mdbRevocable src_node\<rbrakk> \<Longrightarrow> isUntypedCap src_cap proof (prove)
goal (1 subgoal):
 1. \<And>n. \<lbrakk>\<forall>p cap n. m p = Some (CTE cap n) \<longrightarrow> isUntypedCap cap \<longrightarrow> mdbRevocable n; m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); weak_derived' src_cap cap'; m' dest = Some (CTE cap' n); isUntypedCap cap'; \<not> mdbRevocable n; \<not> mdbRevocable src_node\<rbrakk> \<Longrightarrow> isUntypedCap src_cap proof (prove)
goal:
No subgoals! proof (state)
this:
ut_revocable' m'

goal (4 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> irq_control m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> reply_masters_rvk_fb m' proof (chain)
picking this:
m src = Some (CTE src_cap src_node) proof (prove)
using this:
m src = Some (CTE src_cap src_node)

goal (1 subgoal):
 1. m' src = Some (CTE capability.NullCap nullMDBNode) proof (state)
this:
m' src = Some (CTE capability.NullCap nullMDBNode)

goal (4 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> irq_control m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> reply_masters_rvk_fb m' proof (chain)
picking this:
valid_dlist m'
no_0 m'
m' src = Some (CTE capability.NullCap nullMDBNode) proof (prove)
using this:
valid_dlist m'
no_0 m'
m' src = Some (CTE capability.NullCap nullMDBNode)

goal (1 subgoal):
 1. \<And>p. (p, src) \<notin> mdb_next_rel m' proof (prove)
goal (1 subgoal):
 1. \<And>p. \<lbrakk>valid_dlist m'; no_0 m'; m' src = Some (CTE capability.NullCap nullMDBNode); m' \<turnstile> p \<leadsto> src\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>p. \<lbrakk>valid_dlist m'; no_0 m'; m' src = Some (CTE capability.NullCap nullMDBNode); m' \<turnstile> p \<leadsto> src; m' \<turnstile> p \<leftarrow> src\<rbrakk> \<Longrightarrow> False proof (prove)
goal:
No subgoals! proof (state)
this:
(?p, src) \<notin> mdb_next_rel m'

goal (4 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> irq_control m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> reply_masters_rvk_fb m' proof (chain)
picking this:
valid_mdb_ctes m proof (prove)
using this:
valid_mdb_ctes m

goal (1 subgoal):
 1. class_links m proof (state)
this:
class_links m

goal (4 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> class_links m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> irq_control m'
 4. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> reply_masters_rvk_fb m' proof (prove)
using this:
class_links m

goal (1 subgoal):
 1. class_links m' proof (prove)
using this:
class_links m
m src = Some (CTE src_cap src_node)
m dest = Some (CTE capability.NullCap old_dest_node)
weak_derived' src_cap cap'

goal (1 subgoal):
 1. class_links m' proof (prove)
goal (1 subgoal):
 1. \<And>p p' cte cte'. \<lbrakk>\<forall>p p' cte. m p = Some cte \<longrightarrow> (\<forall>cte'. m p' = Some cte' \<longrightarrow> m \<turnstile> p \<leadsto> p' \<longrightarrow> capClass (cteCap cte) = capClass (cteCap cte')); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); capMasterCap src_cap = capMasterCap cap'; capBadge src_cap = capBadge cap'; capASID src_cap = capASID cap'; cap_asid_base' src_cap = cap_asid_base' cap'; cap_vptr' src_cap = cap_vptr' cap'; isReplyCap src_cap \<longrightarrow> capTCBPtr src_cap = capTCBPtr cap' \<and> capReplyMaster src_cap = capReplyMaster cap'; m' p = Some cte; m' p' = Some cte'; m' \<turnstile> p \<leadsto> p'\<rbrakk> \<Longrightarrow> capClass (cteCap cte) = capClass (cteCap cte') proof (prove)
goal (1 subgoal):
 1. \<And>p p' cte cte' x1 x2. \<lbrakk>\<forall>p p' cte. m p = Some cte \<longrightarrow> (\<forall>cte'. m p' = Some cte' \<longrightarrow> m \<turnstile> p \<leadsto> p' \<longrightarrow> capClass (cteCap cte) = capClass (cteCap cte')); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); capMasterCap src_cap = capMasterCap cap'; capBadge src_cap = capBadge cap'; capASID src_cap = capASID cap'; cap_asid_base' src_cap = cap_asid_base' cap'; cap_vptr' src_cap = cap_vptr' cap'; isReplyCap src_cap \<longrightarrow> capTCBPtr src_cap = capTCBPtr cap' \<and> capReplyMaster src_cap = capReplyMaster cap'; m' p = Some cte; m' p' = Some cte'; m' \<turnstile> p \<leadsto> p'; cte = CTE x1 x2\<rbrakk> \<Longrightarrow> capClass (cteCap cte) = capClass (cteCap cte') proof (prove)
goal (1 subgoal):
 1. \<And>p p' cte cte' x1 x2 x1a x2a. \<lbrakk>\<forall>p p' cte. m p = Some cte \<longrightarrow> (\<forall>cte'. m p' = Some cte' \<longrightarrow> m \<turnstile> p \<leadsto> p' \<longrightarrow> capClass (cteCap cte) = capClass (cteCap cte')); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); capMasterCap src_cap = capMasterCap cap'; capBadge src_cap = capBadge cap'; capASID src_cap = capASID cap'; cap_asid_base' src_cap = cap_asid_base' cap'; cap_vptr' src_cap = cap_vptr' cap'; isReplyCap src_cap \<longrightarrow> capTCBPtr src_cap = capTCBPtr cap' \<and> capReplyMaster src_cap = capReplyMaster cap'; m' p = Some cte; m' p' = Some cte'; m' \<turnstile> p \<leadsto> p'; cte = CTE x1 x2; cte' = CTE x1a x2a\<rbrakk> \<Longrightarrow> capClass (cteCap cte) = capClass (cteCap cte') proof (prove)
goal (1 subgoal):
 1. \<And>p p' x1 x2 x1a x2a. \<lbrakk>\<forall>p p' cte. m p = Some cte \<longrightarrow> (\<forall>cte'. m p' = Some cte' \<longrightarrow> m \<turnstile> p \<leadsto> p' \<longrightarrow> capClass (cteCap cte) = capClass (cteCap cte')); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); capMasterCap src_cap = capMasterCap cap'; capBadge src_cap = capBadge cap'; capASID src_cap = capASID cap'; cap_asid_base' src_cap = cap_asid_base' cap'; cap_vptr' src_cap = cap_vptr' cap'; isReplyCap src_cap \<longrightarrow> capTCBPtr src_cap = capTCBPtr cap' \<and> capReplyMaster src_cap = capReplyMaster cap'; m' p = Some (CTE x1 x2); m' p' = Some (CTE x1a x2a); m' \<turnstile> p \<leadsto> p'\<rbrakk> \<Longrightarrow> capClass x1 = capClass x1a proof (prove)
goal (2 subgoals):
 1. \<And>p p' x1 x2 x1a x2a. \<lbrakk>\<forall>p p' cte. m p = Some cte \<longrightarrow> (\<forall>cte'. m p' = Some cte' \<longrightarrow> m \<turnstile> p \<leadsto> p' \<longrightarrow> capClass (cteCap cte) = capClass (cteCap cte')); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); capMasterCap src_cap = capMasterCap cap'; capBadge src_cap = capBadge cap'; capASID src_cap = capASID cap'; cap_asid_base' src_cap = cap_asid_base' cap'; cap_vptr' src_cap = cap_vptr' cap'; isReplyCap src_cap \<longrightarrow> capTCBPtr src_cap = capTCBPtr cap' \<and> capReplyMaster src_cap = capReplyMaster cap'; m' p = Some (CTE x1 x2); m' p' = Some (CTE x1a x2a); m' \<turnstile> p \<leadsto> p'; p' = src\<rbrakk> \<Longrightarrow> capClass x1 = capClass x1a
 2. \<And>p p' x1 x2 x1a x2a. \<lbrakk>\<forall>p p' cte. m p = Some cte \<longrightarrow> (\<forall>cte'. m p' = Some cte' \<longrightarrow> m \<turnstile> p \<leadsto> p' \<longrightarrow> capClass (cteCap cte) = capClass (cteCap cte')); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); capMasterCap src_cap = capMasterCap cap'; capBadge src_cap = capBadge cap'; capASID src_cap = capASID cap'; cap_asid_base' src_cap = cap_asid_base' cap'; cap_vptr' src_cap = cap_vptr' cap'; isReplyCap src_cap \<longrightarrow> capTCBPtr src_cap = capTCBPtr cap' \<and> capReplyMaster src_cap = capReplyMaster cap'; m' p = Some (CTE x1 x2); m' p' = Some (CTE x1a x2a); m' \<turnstile> p \<leadsto> p'; p' \<noteq> src\<rbrakk> \<Longrightarrow> capClass x1 = capClass x1a proof (prove)
goal (1 subgoal):
 1. \<And>p p' x1 x2 x1a x2a. \<lbrakk>\<forall>p p' cte. m p = Some cte \<longrightarrow> (\<forall>cte'. m p' = Some cte' \<longrightarrow> m \<turnstile> p \<leadsto> p' \<longrightarrow> capClass (cteCap cte) = capClass (cteCap cte')); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); capMasterCap src_cap = capMasterCap cap'; capBadge src_cap = capBadge cap'; capASID src_cap = capASID cap'; cap_asid_base' src_cap = cap_asid_base' cap'; cap_vptr' src_cap = cap_vptr' cap'; isReplyCap src_cap \<longrightarrow> capTCBPtr src_cap = capTCBPtr cap' \<and> capReplyMaster src_cap = capReplyMaster cap'; m' p = Some (CTE x1 x2); m' p' = Some (CTE x1a x2a); m' \<turnstile> p \<leadsto> p'; p' \<noteq> src\<rbrakk> \<Longrightarrow> capClass x1 = capClass x1a proof (prove)
goal (1 subgoal):
 1. \<And>p p' x1 x2 x1a x2a. \<lbrakk>\<forall>p p' cte. m p = Some cte \<longrightarrow> (\<forall>cte'. m p' = Some cte' \<longrightarrow> m \<turnstile> p \<leadsto> p' \<longrightarrow> capClass (cteCap cte) = capClass (cteCap cte')); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); capMasterCap src_cap = capMasterCap cap'; capBadge src_cap = capBadge cap'; capASID src_cap = capASID cap'; cap_asid_base' src_cap = cap_asid_base' cap'; cap_vptr' src_cap = cap_vptr' cap'; isReplyCap src_cap \<longrightarrow> capTCBPtr src_cap = capTCBPtr cap' \<and> capReplyMaster src_cap = capReplyMaster cap'; m' p = Some (CTE x1 x2); m' p' = Some (CTE x1a x2a); p' \<noteq> src; if p = src then p' = 0 else if p = dest then m \<turnstile> src \<leadsto> p' else if p' = dest then m \<turnstile> p \<leadsto> src else m \<turnstile> p \<leadsto> p'\<rbrakk> \<Longrightarrow> capClass x1 = capClass x1a proof (prove)
goal (1 subgoal):
 1. \<And>p p' x1 x2 x1a x2a. \<lbrakk>\<forall>p p' cte. m p = Some cte \<longrightarrow> (\<forall>cte'. m p' = Some cte' \<longrightarrow> m \<turnstile> p \<leadsto> p' \<longrightarrow> capClass (cteCap cte) = capClass (cteCap cte')); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); capMasterCap src_cap = capMasterCap cap'; capBadge src_cap = capBadge cap'; capASID src_cap = capASID cap'; cap_asid_base' src_cap = cap_asid_base' cap'; cap_vptr' src_cap = cap_vptr' cap'; isReplyCap src_cap \<longrightarrow> capTCBPtr src_cap = capTCBPtr cap' \<and> capReplyMaster src_cap = capReplyMaster cap'; p' \<noteq> src; if p = src then p' = 0 else if p = dest then m \<turnstile> src \<leadsto> p' else if p' = dest then m \<turnstile> p \<leadsto> src else m \<turnstile> p \<leadsto> p'; if p = src then x1 = capability.NullCap else if p = dest then x1 = cap' else \<exists>node'. m p = Some (CTE x1 node'); if p' = src then x1a = capability.NullCap else if p' = dest then x1a = cap' else \<exists>node'. m p' = Some (CTE x1a node')\<rbrakk> \<Longrightarrow> capClass x1 = capClass x1a proof (prove)
goal (3 subgoals):
 1. \<And>p' x1a node'. \<lbrakk>\<forall>p p' cte. m p = Some cte \<longrightarrow> (\<forall>cte'. m p' = Some cte' \<longrightarrow> m \<turnstile> p \<leadsto> p' \<longrightarrow> capClass (cteCap cte) = capClass (cteCap cte')); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); capMasterCap src_cap = capMasterCap cap'; capBadge src_cap = capBadge cap'; capASID src_cap = capASID cap'; cap_asid_base' src_cap = cap_asid_base' cap'; cap_vptr' src_cap = cap_vptr' cap'; isReplyCap src_cap \<longrightarrow> capTCBPtr src_cap = capTCBPtr cap' \<and> capReplyMaster src_cap = capReplyMaster cap'; p' \<noteq> src; m \<turnstile> src \<leadsto> p'; p' \<noteq> dest; m p' = Some (CTE x1a node')\<rbrakk> \<Longrightarrow> capClass cap' = capClass x1a
 2. \<And>p x1 node'. \<lbrakk>\<forall>p p' cte. m p = Some cte \<longrightarrow> (\<forall>cte'. m p' = Some cte' \<longrightarrow> m \<turnstile> p \<leadsto> p' \<longrightarrow> capClass (cteCap cte) = capClass (cteCap cte')); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); capMasterCap src_cap = capMasterCap cap'; capBadge src_cap = capBadge cap'; capASID src_cap = capASID cap'; cap_asid_base' src_cap = cap_asid_base' cap'; cap_vptr' src_cap = cap_vptr' cap'; isReplyCap src_cap \<longrightarrow> capTCBPtr src_cap = capTCBPtr cap' \<and> capReplyMaster src_cap = capReplyMaster cap'; p \<noteq> src; m \<turnstile> p \<leadsto> src; p \<noteq> dest; m p = Some (CTE x1 node')\<rbrakk> \<Longrightarrow> capClass x1 = capClass cap'
 3. \<And>p p' x1 x1a node' node'a. \<lbrakk>\<forall>p p' cte. m p = Some cte \<longrightarrow> (\<forall>cte'. m p' = Some cte' \<longrightarrow> m \<turnstile> p \<leadsto> p' \<longrightarrow> capClass (cteCap cte) = capClass (cteCap cte')); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); capMasterCap src_cap = capMasterCap cap'; capBadge src_cap = capBadge cap'; capASID src_cap = capASID cap'; cap_asid_base' src_cap = cap_asid_base' cap'; cap_vptr' src_cap = cap_vptr' cap'; isReplyCap src_cap \<longrightarrow> capTCBPtr src_cap = capTCBPtr cap' \<and> capReplyMaster src_cap = capReplyMaster cap'; p' \<noteq> src; p \<noteq> src; m \<turnstile> p \<leadsto> p'; p \<noteq> dest; p' \<noteq> dest; m p = Some (CTE x1 node'); m p' = Some (CTE x1a node'a)\<rbrakk> \<Longrightarrow> capClass x1 = capClass x1a proof (prove)
goal (2 subgoals):
 1. \<And>p x1 node'. \<lbrakk>\<forall>p p' cte. m p = Some cte \<longrightarrow> (\<forall>cte'. m p' = Some cte' \<longrightarrow> m \<turnstile> p \<leadsto> p' \<longrightarrow> capClass (cteCap cte) = capClass (cteCap cte')); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); capMasterCap src_cap = capMasterCap cap'; capBadge src_cap = capBadge cap'; capASID src_cap = capASID cap'; cap_asid_base' src_cap = cap_asid_base' cap'; cap_vptr' src_cap = cap_vptr' cap'; isReplyCap src_cap \<longrightarrow> capTCBPtr src_cap = capTCBPtr cap' \<and> capReplyMaster src_cap = capReplyMaster cap'; p \<noteq> src; m \<turnstile> p \<leadsto> src; p \<noteq> dest; m p = Some (CTE x1 node')\<rbrakk> \<Longrightarrow> capClass x1 = capClass cap'
 2. \<And>p p' x1 x1a node' node'a. \<lbrakk>\<forall>p p' cte. m p = Some cte \<longrightarrow> (\<forall>cte'. m p' = Some cte' \<longrightarrow> m \<turnstile> p \<leadsto> p' \<longrightarrow> capClass (cteCap cte) = capClass (cteCap cte')); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); capMasterCap src_cap = capMasterCap cap'; capBadge src_cap = capBadge cap'; capASID src_cap = capASID cap'; cap_asid_base' src_cap = cap_asid_base' cap'; cap_vptr' src_cap = cap_vptr' cap'; isReplyCap src_cap \<longrightarrow> capTCBPtr src_cap = capTCBPtr cap' \<and> capReplyMaster src_cap = capReplyMaster cap'; p' \<noteq> src; p \<noteq> src; m \<turnstile> p \<leadsto> p'; p \<noteq> dest; p' \<noteq> dest; m p = Some (CTE x1 node'); m p' = Some (CTE x1a node'a)\<rbrakk> \<Longrightarrow> capClass x1 = capClass x1a proof (prove)
goal (1 subgoal):
 1. \<And>p p' x1 x1a node' node'a. \<lbrakk>\<forall>p p' cte. m p = Some cte \<longrightarrow> (\<forall>cte'. m p' = Some cte' \<longrightarrow> m \<turnstile> p \<leadsto> p' \<longrightarrow> capClass (cteCap cte) = capClass (cteCap cte')); m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); capMasterCap src_cap = capMasterCap cap'; capBadge src_cap = capBadge cap'; capASID src_cap = capASID cap'; cap_asid_base' src_cap = cap_asid_base' cap'; cap_vptr' src_cap = cap_vptr' cap'; isReplyCap src_cap \<longrightarrow> capTCBPtr src_cap = capTCBPtr cap' \<and> capReplyMaster src_cap = capReplyMaster cap'; p' \<noteq> src; p \<noteq> src; m \<turnstile> p \<leadsto> p'; p \<noteq> dest; p' \<noteq> dest; m p = Some (CTE x1 node'); m p' = Some (CTE x1a node'a)\<rbrakk> \<Longrightarrow> capClass x1 = capClass x1a proof (prove)
goal:
No subgoals! proof (state)
this:
class_links m'

goal (3 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> irq_control m'
 3. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> reply_masters_rvk_fb m' proof (prove)
goal (1 subgoal):
 1. irq_control m' proof (prove)
using this:
m src = Some (CTE src_cap src_node)
m dest = Some (CTE capability.NullCap old_dest_node)
weak_derived' src_cap cap'

goal (1 subgoal):
 1. irq_control m' proof (prove)
goal (1 subgoal):
 1. \<And>p n. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); weak_derived' src_cap cap'; m' p = Some (CTE capability.IRQControlCap n)\<rbrakk> \<Longrightarrow> mdbRevocable n \<and> (\<forall>p'. (\<exists>n'. m' p' = Some (CTE capability.IRQControlCap n')) \<longrightarrow> p' = p) proof (prove)
goal (1 subgoal):
 1. \<And>p n. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); weak_derived' src_cap cap'; m' p = Some (CTE capability.IRQControlCap n); if p = src then \<not> mdbRevocable n else if p = dest then mdbRevocable n = mdbRevocable src_node else \<exists>node'. m p = Some (CTE capability.IRQControlCap node') \<and> mdbRevocable n = mdbRevocable node'\<rbrakk> \<Longrightarrow> mdbRevocable n \<and> (\<forall>p'. (\<exists>n'. m' p' = Some (CTE capability.IRQControlCap n')) \<longrightarrow> p' = p) proof (prove)
goal (1 subgoal):
 1. \<And>p n. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); weak_derived' src_cap cap'; if p = src then \<not> mdbRevocable n else if p = dest then mdbRevocable n = mdbRevocable src_node else \<exists>node'. m p = Some (CTE capability.IRQControlCap node') \<and> mdbRevocable n = mdbRevocable node'; if p = src then capability.IRQControlCap = capability.NullCap else if p = dest then capability.IRQControlCap = cap' else \<exists>node'. m p = Some (CTE capability.IRQControlCap node')\<rbrakk> \<Longrightarrow> mdbRevocable n \<and> (\<forall>p'. (\<exists>n'. m' p' = Some (CTE capability.IRQControlCap n')) \<longrightarrow> p' = p) proof (prove)
goal (2 subgoals):
 1. \<And>n. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); weak_derived' src_cap capability.IRQControlCap; mdbRevocable n = mdbRevocable src_node; cap' = capability.IRQControlCap\<rbrakk> \<Longrightarrow> mdbRevocable src_node \<and> (\<forall>p'. (\<exists>n'. m' p' = Some (CTE capability.IRQControlCap n')) \<longrightarrow> p' = dest)
 2. \<And>p n node'a. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); weak_derived' src_cap cap'; p \<noteq> src; p \<noteq> dest; m p = Some (CTE capability.IRQControlCap node'a); mdbRevocable n = mdbRevocable node'a\<rbrakk> \<Longrightarrow> mdbRevocable node'a \<and> (\<forall>p'. (\<exists>n'. m' p' = Some (CTE capability.IRQControlCap n')) \<longrightarrow> p' = p) proof (prove)
goal (2 subgoals):
 1. \<And>n. \<lbrakk>m src = Some (CTE capability.IRQControlCap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbRevocable n = mdbRevocable src_node; cap' = capability.IRQControlCap; src_cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> mdbRevocable src_node \<and> (\<forall>p'. (\<exists>n'. m' p' = Some (CTE capability.IRQControlCap n')) \<longrightarrow> p' = dest)
 2. \<And>p n node'a. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); weak_derived' src_cap cap'; p \<noteq> src; p \<noteq> dest; m p = Some (CTE capability.IRQControlCap node'a); mdbRevocable n = mdbRevocable node'a\<rbrakk> \<Longrightarrow> mdbRevocable node'a \<and> (\<forall>p'. (\<exists>n'. m' p' = Some (CTE capability.IRQControlCap n')) \<longrightarrow> p' = p) proof (prove)
goal (2 subgoals):
 1. \<And>n. \<lbrakk>m src = Some (CTE capability.IRQControlCap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbRevocable n = mdbRevocable src_node; cap' = capability.IRQControlCap; src_cap = capability.IRQControlCap; mdbRevocable src_node\<rbrakk> \<Longrightarrow> mdbRevocable src_node \<and> (\<forall>p'. (\<exists>n'. m' p' = Some (CTE capability.IRQControlCap n')) \<longrightarrow> p' = dest)
 2. \<And>p n node'a. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); weak_derived' src_cap cap'; p \<noteq> src; p \<noteq> dest; m p = Some (CTE capability.IRQControlCap node'a); mdbRevocable n = mdbRevocable node'a\<rbrakk> \<Longrightarrow> mdbRevocable node'a \<and> (\<forall>p'. (\<exists>n'. m' p' = Some (CTE capability.IRQControlCap n')) \<longrightarrow> p' = p) proof (prove)
goal (2 subgoals):
 1. \<And>n p' n'. \<lbrakk>m src = Some (CTE capability.IRQControlCap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbRevocable n; cap' = capability.IRQControlCap; src_cap = capability.IRQControlCap; mdbRevocable src_node; m' p' = Some (CTE capability.IRQControlCap n')\<rbrakk> \<Longrightarrow> p' = dest
 2. \<And>p n node'a. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); weak_derived' src_cap cap'; p \<noteq> src; p \<noteq> dest; m p = Some (CTE capability.IRQControlCap node'a); mdbRevocable n = mdbRevocable node'a\<rbrakk> \<Longrightarrow> mdbRevocable node'a \<and> (\<forall>p'. (\<exists>n'. m' p' = Some (CTE capability.IRQControlCap n')) \<longrightarrow> p' = p) proof (prove)
goal (2 subgoals):
 1. \<And>n p' n'. \<lbrakk>m src = Some (CTE capability.IRQControlCap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbRevocable n; cap' = capability.IRQControlCap; src_cap = capability.IRQControlCap; mdbRevocable src_node; if p' = src then capability.IRQControlCap = capability.NullCap else if p' = dest then capability.IRQControlCap = cap' else \<exists>node'. m p' = Some (CTE capability.IRQControlCap node')\<rbrakk> \<Longrightarrow> p' = dest
 2. \<And>p n node'a. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); weak_derived' src_cap cap'; p \<noteq> src; p \<noteq> dest; m p = Some (CTE capability.IRQControlCap node'a); mdbRevocable n = mdbRevocable node'a\<rbrakk> \<Longrightarrow> mdbRevocable node'a \<and> (\<forall>p'. (\<exists>n'. m' p' = Some (CTE capability.IRQControlCap n')) \<longrightarrow> p' = p) proof (prove)
goal (2 subgoals):
 1. \<And>n p' node'. \<lbrakk>m src = Some (CTE capability.IRQControlCap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbRevocable n; cap' = capability.IRQControlCap; src_cap = capability.IRQControlCap; mdbRevocable src_node; p' \<noteq> src; p' \<noteq> dest; m p' = Some (CTE capability.IRQControlCap node')\<rbrakk> \<Longrightarrow> False
 2. \<And>p n node'a. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); weak_derived' src_cap cap'; p \<noteq> src; p \<noteq> dest; m p = Some (CTE capability.IRQControlCap node'a); mdbRevocable n = mdbRevocable node'a\<rbrakk> \<Longrightarrow> mdbRevocable node'a \<and> (\<forall>p'. (\<exists>n'. m' p' = Some (CTE capability.IRQControlCap n')) \<longrightarrow> p' = p) proof (prove)
goal (2 subgoals):
 1. \<And>n p' node'. \<lbrakk>m dest = Some (CTE capability.NullCap old_dest_node); mdbRevocable n; cap' = capability.IRQControlCap; src_cap = capability.IRQControlCap; mdbRevocable src_node; p' \<noteq> src; p' \<noteq> dest; m p' = Some (CTE capability.IRQControlCap node'); p' = src\<rbrakk> \<Longrightarrow> False
 2. \<And>p n node'a. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); weak_derived' src_cap cap'; p \<noteq> src; p \<noteq> dest; m p = Some (CTE capability.IRQControlCap node'a); mdbRevocable n = mdbRevocable node'a\<rbrakk> \<Longrightarrow> mdbRevocable node'a \<and> (\<forall>p'. (\<exists>n'. m' p' = Some (CTE capability.IRQControlCap n')) \<longrightarrow> p' = p) proof (prove)
goal (1 subgoal):
 1. \<And>p n node'a. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); weak_derived' src_cap cap'; p \<noteq> src; p \<noteq> dest; m p = Some (CTE capability.IRQControlCap node'a); mdbRevocable n = mdbRevocable node'a\<rbrakk> \<Longrightarrow> mdbRevocable node'a \<and> (\<forall>p'. (\<exists>n'. m' p' = Some (CTE capability.IRQControlCap n')) \<longrightarrow> p' = p) proof (prove)
goal (1 subgoal):
 1. \<And>p n node'a. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); weak_derived' src_cap cap'; p \<noteq> src; p \<noteq> dest; m p = Some (CTE capability.IRQControlCap node'a); mdbRevocable n = mdbRevocable node'a; mdbRevocable node'a\<rbrakk> \<Longrightarrow> mdbRevocable node'a \<and> (\<forall>p'. (\<exists>n'. m' p' = Some (CTE capability.IRQControlCap n')) \<longrightarrow> p' = p) proof (prove)
goal (1 subgoal):
 1. \<And>p n node'a p' n'. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); weak_derived' src_cap cap'; p \<noteq> src; p \<noteq> dest; m p = Some (CTE capability.IRQControlCap node'a); mdbRevocable n; mdbRevocable node'a; m' p' = Some (CTE capability.IRQControlCap n')\<rbrakk> \<Longrightarrow> p' = p proof (prove)
goal (1 subgoal):
 1. \<And>p n node'a p' n'. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); weak_derived' src_cap cap'; p \<noteq> src; p \<noteq> dest; m p = Some (CTE capability.IRQControlCap node'a); mdbRevocable n; mdbRevocable node'a; if p' = src then capability.IRQControlCap = capability.NullCap else if p' = dest then capability.IRQControlCap = cap' else \<exists>node'. m p' = Some (CTE capability.IRQControlCap node')\<rbrakk> \<Longrightarrow> p' = p proof (prove)
goal (2 subgoals):
 1. \<And>p n node'a. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); weak_derived' src_cap capability.IRQControlCap; p \<noteq> src; p \<noteq> dest; m p = Some (CTE capability.IRQControlCap node'a); mdbRevocable n; mdbRevocable node'a; cap' = capability.IRQControlCap\<rbrakk> \<Longrightarrow> False
 2. \<And>p n node'a p' node'. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); weak_derived' src_cap cap'; p \<noteq> src; p \<noteq> dest; m p = Some (CTE capability.IRQControlCap node'a); mdbRevocable n; mdbRevocable node'a; p' \<noteq> src; p' \<noteq> dest; m p' = Some (CTE capability.IRQControlCap node')\<rbrakk> \<Longrightarrow> p' = p proof (prove)
goal (2 subgoals):
 1. \<And>p n node'a. \<lbrakk>m src = Some (CTE capability.IRQControlCap src_node); m dest = Some (CTE capability.NullCap old_dest_node); p \<noteq> src; p \<noteq> dest; m p = Some (CTE capability.IRQControlCap node'a); mdbRevocable n; mdbRevocable node'a; cap' = capability.IRQControlCap; src_cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> False
 2. \<And>p n node'a p' node'. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); weak_derived' src_cap cap'; p \<noteq> src; p \<noteq> dest; m p = Some (CTE capability.IRQControlCap node'a); mdbRevocable n; mdbRevocable node'a; p' \<noteq> src; p' \<noteq> dest; m p' = Some (CTE capability.IRQControlCap node')\<rbrakk> \<Longrightarrow> p' = p proof (prove)
goal (2 subgoals):
 1. \<And>p n node'a. \<lbrakk>m dest = Some (CTE capability.NullCap old_dest_node); p \<noteq> src; p \<noteq> dest; m p = Some (CTE capability.IRQControlCap node'a); mdbRevocable n; mdbRevocable node'a; cap' = capability.IRQControlCap; src_cap = capability.IRQControlCap; p = src\<rbrakk> \<Longrightarrow> False
 2. \<And>p n node'a p' node'. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); weak_derived' src_cap cap'; p \<noteq> src; p \<noteq> dest; m p = Some (CTE capability.IRQControlCap node'a); mdbRevocable n; mdbRevocable node'a; p' \<noteq> src; p' \<noteq> dest; m p' = Some (CTE capability.IRQControlCap node')\<rbrakk> \<Longrightarrow> p' = p proof (prove)
goal (1 subgoal):
 1. \<And>p n node'a p' node'. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); weak_derived' src_cap cap'; p \<noteq> src; p \<noteq> dest; m p = Some (CTE capability.IRQControlCap node'a); mdbRevocable n; mdbRevocable node'a; p' \<noteq> src; p' \<noteq> dest; m p' = Some (CTE capability.IRQControlCap node')\<rbrakk> \<Longrightarrow> p' = p proof (prove)
goal:
No subgoals! proof (state)
this:
irq_control m'

goal (2 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> reply_masters_rvk_fb m' proof (prove)
goal (1 subgoal):
 1. distinct_zombies m proof (prove)
using this:
valid_mdb_ctes m

goal (1 subgoal):
 1. distinct_zombies m proof (state)
this:
distinct_zombies m

goal (2 subgoals):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> distinct_zombies m'
 2. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> reply_masters_rvk_fb m' proof (prove)
using this:
distinct_zombies m

goal (1 subgoal):
 1. distinct_zombies m' proof (prove)
goal (1 subgoal):
 1. distinct_zombies m \<Longrightarrow> distinct_zombies n proof (prove)
goal (1 subgoal):
 1. distinct_zombies m \<Longrightarrow> distinct_zombies (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) proof (prove)
goal (2 subgoals):
 1. capMasterCap (cteCap (CTE capability.NullCap old_dest_node)) = capMasterCap (cteCap (CTE capability.NullCap nullMDBNode))
 2. capMasterCap (cteCap (CTE src_cap src_node)) = capMasterCap (cteCap (CTE cap' src_node)) proof (prove)
goal (1 subgoal):
 1. capMasterCap (cteCap (CTE src_cap src_node)) = capMasterCap (cteCap (CTE cap' src_node)) proof (prove)
goal (1 subgoal):
 1. weak_derived' src_cap cap' \<Longrightarrow> capMasterCap (cteCap (CTE src_cap src_node)) = capMasterCap (cteCap (CTE cap' src_node)) proof (prove)
goal:
No subgoals! proof (state)
this:
distinct_zombies m'

goal (1 subgoal):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> reply_masters_rvk_fb m' proof (prove)
goal (1 subgoal):
 1. reply_masters_rvk_fb m proof (prove)
using this:
valid_mdb_ctes m

goal (1 subgoal):
 1. reply_masters_rvk_fb m proof (state)
this:
reply_masters_rvk_fb m

goal (1 subgoal):
 1. (isUntypedCap cap' \<Longrightarrow> cap' = src_cap) \<Longrightarrow> reply_masters_rvk_fb m' proof (prove)
using this:
reply_masters_rvk_fb m

goal (1 subgoal):
 1. reply_masters_rvk_fb m' proof (prove)
using this:
reply_masters_rvk_fb m
src \<noteq> dest
weak_derived' src_cap cap'

goal (1 subgoal):
 1. reply_masters_rvk_fb m' proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<forall>cte\<in>ran m. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte) \<longrightarrow> mdbRevocable (cteMDBNode cte) \<and> mdbFirstBadged (cteMDBNode cte); src \<noteq> dest; weak_derived' src_cap cap'\<rbrakk> \<Longrightarrow> \<forall>cte\<in>ran (modify_map (modify_map (modify_map (modify_map m dest (cteCap_update (\<lambda>_. cap'))) src (cteCap_update (\<lambda>_. capability.NullCap))) dest (cteMDBNode_update (\<lambda>m. src_node))) src (cteMDBNode_update (\<lambda>m. nullMDBNode))). isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte) \<longrightarrow> mdbRevocable (cteMDBNode cte) \<and> mdbFirstBadged (cteMDBNode cte) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<forall>cte\<in>ran m. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte) \<longrightarrow> mdbRevocable (cteMDBNode cte) \<and> mdbFirstBadged (cteMDBNode cte); src \<noteq> dest; weak_derived' src_cap cap'\<rbrakk> \<Longrightarrow> \<forall>cte\<in>ran (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)). isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte) \<longrightarrow> mdbRevocable (cteMDBNode cte) \<and> mdbFirstBadged (cteMDBNode cte) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<forall>cte\<in>ran m. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte) \<longrightarrow> mdbRevocable (cteMDBNode cte) \<and> mdbFirstBadged (cteMDBNode cte); src \<noteq> dest; weak_derived' src_cap cap'\<rbrakk> \<Longrightarrow> isReplyCap cap' \<and> capReplyMaster cap' \<longrightarrow> mdbRevocable src_node \<and> mdbFirstBadged src_node
 2. \<lbrakk>\<forall>cte\<in>ran m. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte) \<longrightarrow> mdbRevocable (cteMDBNode cte) \<and> mdbFirstBadged (cteMDBNode cte); src \<noteq> dest; weak_derived' src_cap cap'\<rbrakk> \<Longrightarrow> isReplyCap capability.NullCap \<and> capReplyMaster capability.NullCap \<longrightarrow> mdbRevocable nullMDBNode \<and> mdbFirstBadged nullMDBNode proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<forall>cte\<in>ran m. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte) \<longrightarrow> mdbRevocable (cteMDBNode cte) \<and> mdbFirstBadged (cteMDBNode cte); src \<noteq> dest; weak_derived' src_cap cap'; isReplyCap (cteCap (CTE src_cap src_node)) \<and> capReplyMaster (cteCap (CTE src_cap src_node)) \<longrightarrow> mdbRevocable (cteMDBNode (CTE src_cap src_node)) \<and> mdbFirstBadged (cteMDBNode (CTE src_cap src_node))\<rbrakk> \<Longrightarrow> isReplyCap cap' \<and> capReplyMaster cap' \<longrightarrow> mdbRevocable src_node \<and> mdbFirstBadged src_node
 2. \<lbrakk>\<forall>cte\<in>ran m. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte) \<longrightarrow> mdbRevocable (cteMDBNode cte) \<and> mdbFirstBadged (cteMDBNode cte); src \<noteq> dest; weak_derived' src_cap cap'\<rbrakk> \<Longrightarrow> isReplyCap capability.NullCap \<and> capReplyMaster capability.NullCap \<longrightarrow> mdbRevocable nullMDBNode \<and> mdbFirstBadged nullMDBNode proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<forall>cte\<in>ran m. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte) \<longrightarrow> mdbRevocable (cteMDBNode cte) \<and> mdbFirstBadged (cteMDBNode cte); src \<noteq> dest; capMasterCap src_cap = capMasterCap cap'; capBadge src_cap = capBadge cap'; capASID src_cap = capASID cap'; cap_asid_base' src_cap = cap_asid_base' cap'; cap_vptr' src_cap = cap_vptr' cap'; isReplyCap cap'; capReplyMaster cap'; \<not> isReplyCap src_cap\<rbrakk> \<Longrightarrow> mdbRevocable src_node \<and> mdbFirstBadged src_node
 2. \<lbrakk>\<forall>cte\<in>ran m. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte) \<longrightarrow> mdbRevocable (cteMDBNode cte) \<and> mdbFirstBadged (cteMDBNode cte); src \<noteq> dest; weak_derived' src_cap cap'\<rbrakk> \<Longrightarrow> isReplyCap capability.NullCap \<and> capReplyMaster capability.NullCap \<longrightarrow> mdbRevocable nullMDBNode \<and> mdbFirstBadged nullMDBNode proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<forall>cte\<in>ran m. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte) \<longrightarrow> mdbRevocable (cteMDBNode cte) \<and> mdbFirstBadged (cteMDBNode cte); src \<noteq> dest; capBadge src_cap = capBadge cap'; capASID src_cap = capASID cap'; cap_asid_base' src_cap = cap_asid_base' cap'; cap_vptr' src_cap = cap_vptr' cap'; isReplyCap cap'; capReplyMaster cap'; \<not> isReplyCap src_cap; isReplyCap src_cap = isReplyCap cap'\<rbrakk> \<Longrightarrow> mdbRevocable src_node \<and> mdbFirstBadged src_node
 2. \<lbrakk>\<forall>cte\<in>ran m. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte) \<longrightarrow> mdbRevocable (cteMDBNode cte) \<and> mdbFirstBadged (cteMDBNode cte); src \<noteq> dest; weak_derived' src_cap cap'\<rbrakk> \<Longrightarrow> isReplyCap capability.NullCap \<and> capReplyMaster capability.NullCap \<longrightarrow> mdbRevocable nullMDBNode \<and> mdbFirstBadged nullMDBNode proof (prove)
goal:
No subgoals! proof (state)
this:
reply_masters_rvk_fb m'

goal:
No subgoals!