(* malloc token, which accounts for the size field and padding.
 * n is the size requested
 * Unfolding the definition reveals the stored size value and the
 * actual size of the block. 
 * Note that offset_val is in bytes, not like C pointer arith. *)
Definition malloc_token' (sh: share) (n: Z) (p: val): mpred := 
   data_at Tsh tuint (offset_val (- WORD) p) (Vint (Int.repr n)) 
 * memory_block Tsh ((bin2sizeZ(size2binZ(n)) - n)) (offset_val n p).

(* Specifications: *)
Lemma malloc_token'_precise: forall sh n p, predicates_sl.precise (malloc_token' sh n p).
Lemma body_bin2size: semax_body Vprog Gprog f_bin2size bin2size_spec.
Lemma body_size2bin: semax_body Vprog Gprog f_size2bin size2bin_spec.
Lemma body_fill_bin: semax_body Vprog Gprog f_fill_bin fill_bin_spec.
Lemma body_malloc_small: semax_body Vprog Gprog f_malloc_small malloc_small_spec.
Lemma body_free_small: semax_body Vprog Gprog f_free_small free_small_spec.
Lemma body_main: semax_body Vprog Gprog f_main main_spec.
Lemma prog_correct: semax_prog prog Vprog Gprog.