proof of __po_hi_msg_length checked
proof of __po_hi_msg_append
proof of __po_hi_msg_append_msg checked