(* malloc token, which accounts for the size field and padding.
 * n is the size requested
 * Unfolding the definition reveals the stored size value and the
 * actual size of the block. 
 * Note that offset_val is in bytes, not like C pointer arith. *)
Definition malloc_token' (sh: share) (n: Z) (p: val): mpred := 
   data_at Tsh tuint (offset_val (- WORD) p) (Vint (Int.repr n)) 
 * memory_block Tsh ((bin2sizeZ(size2binZ(n)) - n)) (offset_val n p).

Lemma prog_correct: semax_prog prog Vprog Gprog.