Section alloc_fd.
Variable (fs: fs).
Fixpoint find_unused_fd (n: nat) (fdtable: int -> option (fmode*fptr)) :=
match n with
| O => None
| S n' => match fdtable (Int.repr (Z_of_nat n)) with
| None => Some (Int.repr (Z_of_nat n))
| Some _ => find_unused_fd n' fdtable
end
end.
Definition max_fds: nat := nat_of_Z (Int.unsigned (get_max_fds fs)).
Definition alloc_fd := find_unused_fd max_fds (get_fdtable fs).

Lemma alloc_fd_success :
(get_nfiles_open fs < max_fds)%nat -> exists unused_fd, alloc_fd = Some unused_fd.