(* Special case when p = null *)
Definition lseq p := lseg p null.

(* Specifications: *)
Lemma lseq_null xs h : def h -> h \In lseq null xs -> xs = [::] /\ h = empty.
Program
Definition remove p :
STsep (fun i => exists xs, i \In lseq p xs,
fun y i m => forall xs, i \In lseq p xs ->
exists q, m \In lseq q (behead xs) /\ y = Val q) :=
Do (If p == null then ret p
else pnext <-- !(p .+ 1);
dealloc p;; dealloc p .+ 1;;
ret pnext).