Section safety_Clight.
unfold bounded_mem, bounded_maps.bounded_map, init_mem, init_m.
destruct CPROOF; simpl in *.
destruct (Genv.init_mem (Ctypes.program_of_program CSL_prog)) eqn:HH;
[ | congruence].
generalize HH; eauto; clear HH. simpl.
pose (K:= (prog_defs (Ctypes.program_of_program CSL_prog))).
pose (m':= Mem.empty).
unfold Genv.init_mem.
assert ( bounded_mem m').
{ subst; apply bounded_empty_mem. }
generalize (H); clear H.
fold K m'.
generalize (m'); clear m'.
induction K.
- intros ? ? HH; inversion HH.
simpl.
subst; eauto.
- intros M BM; simpl.
destruct (Genv.alloc_global (Genv.globalenv (Ctypes.program_of_program CSL_prog)) M a) eqn: AA;
try solve[intros HH; inversion HH].
intros HH.
pose (@Clight_bounds.alloc_global_bounded
_ _
(Genv.globalenv (Ctypes.program_of_program CSL_prog))
M m0 a).
eapply b in BM; eauto.
Qed.

Lemma Initial_dry_safety:
forall (U : semax_invariant.schedule) (n : nat),
exists init_U init_tr init_st,
(semantics.initial_core (MachineSemantics U (Some ( getCurPerm (juicy_mem.m_dry (init_jmem n)), empty_map)))) 0 init_genv (juicy_mem.m_dry (init_jmem n)) init_point nil =
Some ((init_U, init_tr, init_st), None) /\
forall U',
new_valid (mk_nstate (U', init_tr, init_st) (proj1_sig (init_mem CPROOF))) U' ->
safe_new_step_bound (globalenv prog) (U', init_tr, init_st)
(proj1_sig (init_mem CPROOF)).