forward.
apply semax_pre
with  (fun s' => EX x: adr, (next (s' p) x * |>lseg x 0 * lseg (s' s) (s' p) * allocpool (s' a)) &&
cont DONEspec (s' r)).
intro s'. normalize.
rewrite (lseg_neq (s' p)) by auto. normalize. apply exp_right with y.
apply andp_derives; auto.
apply sepcon_derives; auto.
rewrite sepcon_comm. auto.
apply (@semax_exp' _ 0). intro tail.
do 2 rewrite' @sepcon_assoc.
apply semax_pre with (fun s0 => next (eval (Var p) s0) tail * TT &&
|> subst p tail (fun s1 =>
lseg (eval (Var p) s1) 0 * lseg (eval (Var s) s1) (eval (Var p) s1)
* allocpool (eval (Var a) s1)
&& cont DONEspec (s1 r)) s0);
[ | apply semax_load_next; auto 50].
intro.
unfold subst. simpl. rewrite env_gss.
rewrite env_gso by (intro Hx; inv Hx).
rewrite env_gso by (intro Hx; inv Hx).
rewrite env_gso by (intro Hx; inv Hx).
apply andp_right.
apply andp_left1. apply sepcon_derives; auto.
normalize.
rewrite later_andp.
apply andp_derives.
rewrite sepcon_comm.
rewrite sepcon_assoc. rewrite sepcon_comm.
eapply derives_trans. apply sepcon_derives; [ apply now_later | apply derives_refl].
rewrite <- later_sepcon.
apply later_derives.
rewrite sepcon_comm.
rewrite (sepcon_assoc _ (allocpool _)).
repeat rewrite <- sepcon_assoc.
rewrite sepcon_comm.
repeat rewrite <- sepcon_assoc.
apply sepcon_derives; auto.
rewrite sepcon_comm. rewrite (sepcon_comm (lseg tail 0)).
rewrite <- sepcon_assoc.
apply lseg_cons_in_list_context.
apply now_later.
forward. normalize.
apply andp_left1.
rewrite (sepcon_comm (lseg (s0 s) _)). auto.
forward.
normalize.
apply andp_left1. apply andp_left2. apply derives_refl.
simpl. normalize.
autorewrite with args. rewrite H. rewrite lseg_eq. normalize.
apply andp_left1.
apply andp_left1. auto.
Qed.

(* Specifications: *)
Lemma prove_DONE: semax_body myspec DONEspec DONEbody.
eapply semax_pre; [intro ; call_tac; apply derives_refl | simpl ].