Definition null_or_offset x q y :=
match x with
Vint i => i=Int.zero /\ y=nullval
| Vptr _ _ => y=offset_val q x
| _ => False
end.
Definition byte_at x i mbytes :=
match x with
Vint _ => Byte.zero
| _ => Znth i mbytes
end.

(* Specifications: *)
Lemma bxorlist_snoc x q y b l mbytes xbytes
(M:null_or_offset x q y )
(X: bxorlist (bytes_at x q (Zlength l) mbytes)
(sublist 0 (Zlength l) xbytes) = Some l):
0<= q -> Zlength l < Zlength xbytes ->  q+ Zlength l < Zlength mbytes ->
b = Byte.xor (byte_at x (Zlength l + q) mbytes)
(Znth (Zlength l) xbytes) ->
bxorlist (bytes_at x q (Zlength l  + 1) mbytes)
(sublist 0 (Zlength l  + 1) xbytes) = Some (l ++ [b]).