Comprehensive formal verification of an OS microkernel
All Your IFCException Are Belong to Us