#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
struct target {
  int dummy;
};

/* Variables and functions */
char *copy_params(char **, int, int *);
scalar_t__ dump_int_from_mem(unsigned int, char **, struct target *);
scalar_t__ dump_long_unsigned_int_from_mem(unsigned int, char **,
                                           struct target *);
scalar_t__ dump_n_bytes_from_mem(unsigned int, char **, struct target *, int);
scalar_t__ dump_ptr(unsigned int, char **);
scalar_t__ dump_unsigned_int_from_mem(unsigned int, char **, struct target *);
int /*<<< orphan*/ free_dumped_params(char **, int);
void *malloc(int);
unsigned int read_ptr_from_mem(unsigned int, struct target *);
int dump___sysctl_args(int depth, unsigned int addr, char **dumped_params,
                       struct target *target) {
  char **dumped_type_params;
  unsigned int arm_tracing_name = addr;
  unsigned int arm_tracing_nlen = addr + 4;
  unsigned int arm_tracing_oldval = addr + 8;
  unsigned int arm_tracing_oldlenp = addr + 12;
  unsigned int arm_tracing_newval = addr + 16;
  unsigned int arm_tracing_newlen = addr + 20;
  unsigned int arm_tracing___unused = addr + 24;
  int len = 0;
  if (depth < 0) {
    *dumped_params = malloc(0);
    return len;
  }
  dumped_type_params = malloc(7 * (sizeof(char *)));
  arm_tracing_name = read_ptr_from_mem(arm_tracing_name, target);
  arm_tracing_oldval = read_ptr_from_mem(arm_tracing_oldval, target);
  arm_tracing_oldlenp = read_ptr_from_mem(arm_tracing_oldlenp, target);
  arm_tracing_newval = read_ptr_from_mem(arm_tracing_newval, target);
  if (depth == 0) {
    len += dump_ptr(arm_tracing_name, &dumped_type_params[0]);
    len += dump_int_from_mem(arm_tracing_nlen, &dumped_type_params[1], target);
    len += dump_ptr(arm_tracing_oldval, &dumped_type_params[2]);
    len += dump_ptr(arm_tracing_oldlenp, &dumped_type_params[3]);
    len += dump_ptr(arm_tracing_newval, &dumped_type_params[4]);
    len += dump_unsigned_int_from_mem(arm_tracing_newlen,
                                      &dumped_type_params[5], target);
    len += dump_long_unsigned_int_from_mem(arm_tracing___unused,
                                           &dumped_type_params[6], target);
    *dumped_params = copy_params(dumped_type_params, 7, &len);
    free_dumped_params(dumped_type_params, 7);
    return len;
  }
  if (depth >= 1) {
    len += dump_int_from_mem(arm_tracing_name, &dumped_type_params[0], target);
    len += dump_int_from_mem(arm_tracing_nlen, &dumped_type_params[1], target);
    len += dump_n_bytes_from_mem(arm_tracing_oldval, &dumped_type_params[2],
                                 target, 256);
    len += dump_unsigned_int_from_mem(arm_tracing_oldlenp,
                                      &dumped_type_params[3], target);
    len += dump_n_bytes_from_mem(arm_tracing_newval, &dumped_type_params[4],
                                 target, 256);
    len += dump_unsigned_int_from_mem(arm_tracing_newlen,
                                      &dumped_type_params[5], target);
    len += dump_long_unsigned_int_from_mem(arm_tracing___unused,
                                           &dumped_type_params[6], target);
  }
  *dumped_params = copy_params(dumped_type_params, 7, &len);
  free_dumped_params(dumped_type_params, 7);
  return len;
}


x86 assembly (clang, -O0):
<dump___sysctl_args>:
push   %rbp
mov    %rsp,%rbp
sub    $0x50,%rsp
mov    %edi,-0x8(%rbp)
mov    %esi,-0xc(%rbp)
mov    %rdx,-0x18(%rbp)
mov    %rcx,-0x20(%rbp)
mov    -0xc(%rbp),%eax
mov    %eax,-0x2c(%rbp)
mov    -0xc(%rbp),%eax
add    $0x4,%eax
mov    %eax,-0x30(%rbp)
mov    -0xc(%rbp),%eax
add    $0x8,%eax
mov    %eax,-0x34(%rbp)
mov    -0xc(%rbp),%eax
add    $0xc,%eax
mov    %eax,-0x38(%rbp)
mov    -0xc(%rbp),%eax
add    $0x10,%eax
mov    %eax,-0x3c(%rbp)
mov    -0xc(%rbp),%eax
add    $0x14,%eax
mov    %eax,-0x40(%rbp)
mov    -0xc(%rbp),%eax
add    $0x18,%eax
mov    %eax,-0x44(%rbp)
movl   $0x0,-0x48(%rbp)
cmpl   $0x0,-0x8(%rbp)
jge    120f <dump___sysctl_args+0x7f>
xor    %edi,%edi
call   1090 <malloc@plt>
mov    %rax,%rcx
mov    -0x18(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x48(%rbp),%eax
mov    %eax,-0x4(%rbp)
jmp    1492 <dump___sysctl_args+0x302>
mov    $0x38,%edi
call   1090 <malloc@plt>
mov    %rax,-0x28(%rbp)
mov    -0x2c(%rbp),%edi
mov    -0x20(%rbp),%rsi
call   1080 <read_ptr_from_mem@plt>
mov    %eax,-0x2c(%rbp)
mov    -0x34(%rbp),%edi
mov    -0x20(%rbp),%rsi
call   1080 <read_ptr_from_mem@plt>
mov    %eax,-0x34(%rbp)
mov    -0x38(%rbp),%edi
mov    -0x20(%rbp),%rsi
call   1080 <read_ptr_from_mem@plt>
mov    %eax,-0x38(%rbp)
mov    -0x3c(%rbp),%edi
mov    -0x20(%rbp),%rsi
call   1080 <read_ptr_from_mem@plt>
mov    %eax,-0x3c(%rbp)
cmpl   $0x0,-0x8(%rbp)
jne    136b <dump___sysctl_args+0x1db>
mov    -0x2c(%rbp),%edi
mov    -0x28(%rbp),%rsi
call   1060 <dump_ptr@plt>
mov    %rax,%rcx
movslq -0x48(%rbp),%rax
add    %rcx,%rax
mov    %eax,-0x48(%rbp)
mov    -0x30(%rbp),%edi
mov    -0x28(%rbp),%rsi
add    $0x8,%rsi
mov    -0x20(%rbp),%rdx
call   10b0 <dump_int_from_mem@plt>
mov    %rax,%rcx
movslq -0x48(%rbp),%rax
add    %rcx,%rax
mov    %eax,-0x48(%rbp)
mov    -0x34(%rbp),%edi
mov    -0x28(%rbp),%rsi
add    $0x10,%rsi
call   1060 <dump_ptr@plt>
mov    %rax,%rcx
movslq -0x48(%rbp),%rax
add    %rcx,%rax
mov    %eax,-0x48(%rbp)
mov    -0x38(%rbp),%edi
mov    -0x28(%rbp),%rsi
add    $0x18,%rsi
call   1060 <dump_ptr@plt>
mov    %rax,%rcx
movslq -0x48(%rbp),%rax
add    %rcx,%rax
mov    %eax,-0x48(%rbp)
mov    -0x3c(%rbp),%edi
mov    -0x28(%rbp),%rsi
add    $0x20,%rsi
call   1060 <dump_ptr@plt>
mov    %rax,%rcx
movslq -0x48(%rbp),%rax
add    %rcx,%rax
mov    %eax,-0x48(%rbp)
mov    -0x40(%rbp),%edi
mov    -0x28(%rbp),%rsi
add    $0x28,%rsi
mov    -0x20(%rbp),%rdx
call   10a0 <dump_unsigned_int_from_mem@plt>
mov    %rax,%rcx
movslq -0x48(%rbp),%rax
add    %rcx,%rax
mov    %eax,-0x48(%rbp)
mov    -0x44(%rbp),%edi
mov    -0x28(%rbp),%rsi
add    $0x30,%rsi
mov    -0x20(%rbp),%rdx
call   1040 <dump_long_unsigned_int_from_mem@plt>
mov    %rax,%rcx
movslq -0x48(%rbp),%rax
add    %rcx,%rax
mov    %eax,-0x48(%rbp)
mov    -0x28(%rbp),%rdi
mov    $0x7,%esi
lea    -0x48(%rbp),%rdx
call   1070 <copy_params@plt>
mov    %rax,%rcx
mov    -0x18(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x28(%rbp),%rdi
mov    $0x7,%esi
call   1050 <free_dumped_params@plt>
mov    -0x48(%rbp),%eax
mov    %eax,-0x4(%rbp)
jmp    1492 <dump___sysctl_args+0x302>
cmpl   $0x1,-0x8(%rbp)
jl     1462 <dump___sysctl_args+0x2d2>
mov    -0x2c(%rbp),%edi
mov    -0x28(%rbp),%rsi
mov    -0x20(%rbp),%rdx
call   10b0 <dump_int_from_mem@plt>
mov    %rax,%rcx
movslq -0x48(%rbp),%rax
add    %rcx,%rax
mov    %eax,-0x48(%rbp)
mov    -0x30(%rbp),%edi
mov    -0x28(%rbp),%rsi
add    $0x8,%rsi
mov    -0x20(%rbp),%rdx
call   10b0 <dump_int_from_mem@plt>
mov    %rax,%rcx
movslq -0x48(%rbp),%rax
add    %rcx,%rax
mov    %eax,-0x48(%rbp)
mov    -0x34(%rbp),%edi
mov    -0x28(%rbp),%rsi
add    $0x10,%rsi
mov    -0x20(%rbp),%rdx
mov    $0x100,%ecx
call   1030 <dump_n_bytes_from_mem@plt>
mov    %rax,%rcx
movslq -0x48(%rbp),%rax
add    %rcx,%rax
mov    %eax,-0x48(%rbp)
mov    -0x38(%rbp),%edi
mov    -0x28(%rbp),%rsi
add    $0x18,%rsi
mov    -0x20(%rbp),%rdx
call   10a0 <dump_unsigned_int_from_mem@plt>
mov    %rax,%rcx
movslq -0x48(%rbp),%rax
add    %rcx,%rax
mov    %eax,-0x48(%rbp)
mov    -0x3c(%rbp),%edi
mov    -0x28(%rbp),%rsi
add    $0x20,%rsi
mov    -0x20(%rbp),%rdx
mov    $0x100,%ecx
call   1030 <dump_n_bytes_from_mem@plt>
mov    %rax,%rcx
movslq -0x48(%rbp),%rax
add    %rcx,%rax
mov    %eax,-0x48(%rbp)
mov    -0x40(%rbp),%edi
mov    -0x28(%rbp),%rsi
add    $0x28,%rsi
mov    -0x20(%rbp),%rdx
call   10a0 <dump_unsigned_int_from_mem@plt>
mov    %rax,%rcx
movslq -0x48(%rbp),%rax
add    %rcx,%rax
mov    %eax,-0x48(%rbp)
mov    -0x44(%rbp),%edi
mov    -0x28(%rbp),%rsi
add    $0x30,%rsi
mov    -0x20(%rbp),%rdx
call   1040 <dump_long_unsigned_int_from_mem@plt>
mov    %rax,%rcx
movslq -0x48(%rbp),%rax
add    %rcx,%rax
mov    %eax,-0x48(%rbp)
mov    -0x28(%rbp),%rdi
mov    $0x7,%esi
lea    -0x48(%rbp),%rdx
call   1070 <copy_params@plt>
mov    %rax,%rcx
mov    -0x18(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x28(%rbp),%rdi
mov    $0x7,%esi
call   1050 <free_dumped_params@plt>
mov    -0x48(%rbp),%eax
mov    %eax,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x50,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<dump___sysctl_args>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x28,%rsp
mov    %rdx,%rbp
movl   $0x0,0x8(%rsp)
test   %edi,%edi
js     1295 <dump___sysctl_args+0x105>
mov    %rcx,%r14
mov    %esi,%ebx
mov    %edi,%r12d
mov    %rbp,0x20(%rsp)
lea    0x4(%rbx),%eax
mov    %eax,0x10(%rsp)
lea    0x14(%rbx),%eax
mov    %eax,0x18(%rsp)
lea    0x18(%rbx),%eax
mov    %eax,0x1c(%rsp)
lea    0x10(%rbx),%eax
mov    %eax,0xc(%rsp)
lea    0xc(%rbx),%ebp
lea    0x8(%rbx),%r13d
mov    $0x38,%edi
call   1090 <malloc@plt>
mov    %rax,%r15
mov    %ebx,%edi
mov    %r14,%rsi
call   1080 <read_ptr_from_mem@plt>
mov    %eax,%ebx
mov    %r13d,%edi
mov    %r14,%rsi
call   1080 <read_ptr_from_mem@plt>
mov    %eax,%r13d
mov    %ebp,%edi
mov    %r14,%rsi
call   1080 <read_ptr_from_mem@plt>
mov    %eax,0x14(%rsp)
mov    0xc(%rsp),%edi
mov    %r14,%rsi
call   1080 <read_ptr_from_mem@plt>
mov    %eax,0xc(%rsp)
mov    %ebx,%edi
mov    %r15,%rsi
test   %r12d,%r12d
je     12a5 <dump___sysctl_args+0x115>
mov    %r14,%rdx
call   10b0 <dump_int_from_mem@plt>
mov    %rax,%rbx
lea    0x8(%r15),%rsi
mov    0x10(%rsp),%edi
mov    %r14,%rdx
call   10b0 <dump_int_from_mem@plt>
mov    %rax,%rbp
add    %ebx,%ebp
lea    0x10(%r15),%rsi
mov    %r13d,%edi
mov    %r14,%rdx
mov    $0x100,%ecx
call   1030 <dump_n_bytes_from_mem@plt>
mov    %rax,%rbx
add    %ebp,%ebx
lea    0x18(%r15),%rsi
mov    0x14(%rsp),%edi
mov    %r14,%rdx
call   10a0 <dump_unsigned_int_from_mem@plt>
mov    %rax,%rbp
add    %ebx,%ebp
lea    0x20(%r15),%rsi
mov    0xc(%rsp),%edi
mov    %r14,%rdx
mov    $0x100,%ecx
call   1030 <dump_n_bytes_from_mem@plt>
jmp    12f2 <dump___sysctl_args+0x162>
xor    %edi,%edi
call   1090 <malloc@plt>
mov    %rax,0x0(%rbp)
jmp    134c <dump___sysctl_args+0x1bc>
call   1060 <dump_ptr@plt>
mov    %rax,%rbx
lea    0x8(%r15),%rsi
mov    0x10(%rsp),%edi
mov    %r14,%rdx
call   10b0 <dump_int_from_mem@plt>
mov    %rax,%rbp
add    %ebx,%ebp
lea    0x10(%r15),%rsi
mov    %r13d,%edi
call   1060 <dump_ptr@plt>
mov    %rax,%rbx
add    %ebp,%ebx
lea    0x18(%r15),%rsi
mov    0x14(%rsp),%edi
call   1060 <dump_ptr@plt>
mov    %rax,%rbp
add    %ebx,%ebp
lea    0x20(%r15),%rsi
mov    0xc(%rsp),%edi
call   1060 <dump_ptr@plt>
mov    %rax,%rbx
add    %ebp,%ebx
lea    0x28(%r15),%rsi
mov    0x18(%rsp),%edi
mov    %r14,%rdx
call   10a0 <dump_unsigned_int_from_mem@plt>
mov    %rax,%rbp
add    %ebx,%ebp
mov    %r15,%rsi
add    $0x30,%rsi
mov    0x1c(%rsp),%edi
mov    %r14,%rdx
call   1040 <dump_long_unsigned_int_from_mem@plt>
add    %ebp,%eax
mov    %eax,0x8(%rsp)
lea    0x8(%rsp),%rdx
mov    %r15,%rdi
mov    $0x7,%esi
call   1070 <copy_params@plt>
mov    0x20(%rsp),%rcx
mov    %rax,(%rcx)
mov    %r15,%rdi
mov    $0x7,%esi
call   1050 <free_dumped_params@plt>
mov    0x8(%rsp),%eax
add    $0x28,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
%struct.target = type { i32 }
define i32 @dump___sysctl_args(i32 %0, i32 %1, i8** %2, %struct.target* %3) {
%5 = alloca i32
%6 = alloca i32
%7 = alloca i32
%8 = alloca i8**
%9 = alloca %struct.target*
%10 = alloca i8**
%11 = alloca i32
%12 = alloca i32
%13 = alloca i32
%14 = alloca i32
%15 = alloca i32
%16 = alloca i32
%17 = alloca i32
%18 = alloca i32
store i32 %0, i32* %6
store i32 %1, i32* %7
store i8** %2, i8*** %8
store %struct.target* %3, %struct.target** %9
%19 = load i32, i32* %7
store i32 %19, i32* %11
%20 = load i32, i32* %7
%21 = add i32 %20, 4
store i32 %21, i32* %12
%22 = load i32, i32* %7
%23 = add i32 %22, 8
store i32 %23, i32* %13
%24 = load i32, i32* %7
%25 = add i32 %24, 12
store i32 %25, i32* %14
%26 = load i32, i32* %7
%27 = add i32 %26, 16
store i32 %27, i32* %15
%28 = load i32, i32* %7
%29 = add i32 %28, 20
store i32 %29, i32* %16
%30 = load i32, i32* %7
%31 = add i32 %30, 24
store i32 %31, i32* %17
store i32 0, i32* %18
%32 = load i32, i32* %6
%33 = icmp slt i32 %32, 0
br i1 %33, label %34, label %38
34: ; preds = %4
%35 = call i8* @malloc(i32 0)
%36 = load i8**, i8*** %8
store i8* %35, i8** %36
%37 = load i32, i32* %18
store i32 %37, i32* %5
br label %195
38: ; preds = %4
%39 = call i8* @malloc(i32 56)
%40 = bitcast i8* %39 to i8**
store i8** %40, i8*** %10
%41 = load i32, i32* %11
%42 = load %struct.target*, %struct.target** %9
%43 = call i32 @read_ptr_from_mem(i32 %41, %struct.target* %42)
store i32 %43, i32* %11
%44 = load i32, i32* %13
%45 = load %struct.target*, %struct.target** %9
%46 = call i32 @read_ptr_from_mem(i32 %44, %struct.target* %45)
store i32 %46, i32* %13
%47 = load i32, i32* %14
%48 = load %struct.target*, %struct.target** %9
%49 = call i32 @read_ptr_from_mem(i32 %47, %struct.target* %48)
store i32 %49, i32* %14
%50 = load i32, i32* %15
%51 = load %struct.target*, %struct.target** %9
%52 = call i32 @read_ptr_from_mem(i32 %50, %struct.target* %51)
store i32 %52, i32* %15
%53 = load i32, i32* %6
%54 = icmp eq i32 %53, 0
br i1 %54, label %55, label %121
55: ; preds = %38
%56 = load i32, i32* %11
%57 = load i8**, i8*** %10
%58 = getelementptr inbounds i8*, i8** %57, i64 0
%59 = call i64 @dump_ptr(i32 %56, i8** %58)
%60 = load i32, i32* %18
%61 = sext i32 %60 to i64
%62 = add nsw i64 %61, %59
%63 = trunc i64 %62 to i32
store i32 %63, i32* %18
%64 = load i32, i32* %12
%65 = load i8**, i8*** %10
%66 = getelementptr inbounds i8*, i8** %65, i64 1
%67 = load %struct.target*, %struct.target** %9
%68 = call i64 @dump_int_from_mem(i32 %64, i8** %66, %struct.target* %67)
%69 = load i32, i32* %18
%70 = sext i32 %69 to i64
%71 = add nsw i64 %70, %68
%72 = trunc i64 %71 to i32
store i32 %72, i32* %18
%73 = load i32, i32* %13
%74 = load i8**, i8*** %10
%75 = getelementptr inbounds i8*, i8** %74, i64 2
%76 = call i64 @dump_ptr(i32 %73, i8** %75)
%77 = load i32, i32* %18
%78 = sext i32 %77 to i64
%79 = add nsw i64 %78, %76
%80 = trunc i64 %79 to i32
store i32 %80, i32* %18
%81 = load i32, i32* %14
%82 = load i8**, i8*** %10
%83 = getelementptr inbounds i8*, i8** %82, i64 3
%84 = call i64 @dump_ptr(i32 %81, i8** %83)
%85 = load i32, i32* %18
%86 = sext i32 %85 to i64
%87 = add nsw i64 %86, %84
%88 = trunc i64 %87 to i32
store i32 %88, i32* %18
%89 = load i32, i32* %15
%90 = load i8**, i8*** %10
%91 = getelementptr inbounds i8*, i8** %90, i64 4
%92 = call i64 @dump_ptr(i32 %89, i8** %91)
%93 = load i32, i32* %18
%94 = sext i32 %93 to i64
%95 = add nsw i64 %94, %92
%96 = trunc i64 %95 to i32
store i32 %96, i32* %18
%97 = load i32, i32* %16
%98 = load i8**, i8*** %10
%99 = getelementptr inbounds i8*, i8** %98, i64 5
%100 = load %struct.target*, %struct.target** %9
%101 = call i64 @dump_unsigned_int_from_mem(i32 %97, i8** %99, %struct.target* %100)
%102 = load i32, i32* %18
%103 = sext i32 %102 to i64
%104 = add nsw i64 %103, %101
%105 = trunc i64 %104 to i32
store i32 %105, i32* %18
%106 = load i32, i32* %17
%107 = load i8**, i8*** %10
%108 = getelementptr inbounds i8*, i8** %107, i64 6
%109 = load %struct.target*, %struct.target** %9
%110 = call i64 @dump_long_unsigned_int_from_mem(i32 %106, i8** %108, %struct.target* %109)
%111 = load i32, i32* %18
%112 = sext i32 %111 to i64
%113 = add nsw i64 %112, %110
%114 = trunc i64 %113 to i32
store i32 %114, i32* %18
%115 = load i8**, i8*** %10
%116 = call i8* @copy_params(i8** %115, i32 7, i32* %18)
%117 = load i8**, i8*** %8
store i8* %116, i8** %117
%118 = load i8**, i8*** %10
%119 = call i32 @free_dumped_params(i8** %118, i32 7)
%120 = load i32, i32* %18
store i32 %120, i32* %5
br label %195
121: ; preds = %38
%122 = load i32, i32* %6
%123 = icmp sge i32 %122, 1
br i1 %123, label %124, label %188
124: ; preds = %121
%125 = load i32, i32* %11
%126 = load i8**, i8*** %10
%127 = getelementptr inbounds i8*, i8** %126, i64 0
%128 = load %struct.target*, %struct.target** %9
%129 = call i64 @dump_int_from_mem(i32 %125, i8** %127, %struct.target* %128)
%130 = load i32, i32* %18
%131 = sext i32 %130 to i64
%132 = add nsw i64 %131, %129
%133 = trunc i64 %132 to i32
store i32 %133, i32* %18
%134 = load i32, i32* %12
%135 = load i8**, i8*** %10
%136 = getelementptr inbounds i8*, i8** %135, i64 1
%137 = load %struct.target*, %struct.target** %9
%138 = call i64 @dump_int_from_mem(i32 %134, i8** %136, %struct.target* %137)
%139 = load i32, i32* %18
%140 = sext i32 %139 to i64
%141 = add nsw i64 %140, %138
%142 = trunc i64 %141 to i32
store i32 %142, i32* %18
%143 = load i32, i32* %13
%144 = load i8**, i8*** %10
%145 = getelementptr inbounds i8*, i8** %144, i64 2
%146 = load %struct.target*, %struct.target** %9
%147 = call i64 @dump_n_bytes_from_mem(i32 %143, i8** %145, %struct.target* %146, i32 256)
%148 = load i32, i32* %18
%149 = sext i32 %148 to i64
%150 = add nsw i64 %149, %147
%151 = trunc i64 %150 to i32
store i32 %151, i32* %18
%152 = load i32, i32* %14
%153 = load i8**, i8*** %10
%154 = getelementptr inbounds i8*, i8** %153, i64 3
%155 = load %struct.target*, %struct.target** %9
%156 = call i64 @dump_unsigned_int_from_mem(i32 %152, i8** %154, %struct.target* %155)
%157 = load i32, i32* %18
%158 = sext i32 %157 to i64
%159 = add nsw i64 %158, %156
%160 = trunc i64 %159 to i32
store i32 %160, i32* %18
%161 = load i32, i32* %15
%162 = load i8**, i8*** %10
%163 = getelementptr inbounds i8*, i8** %162, i64 4
%164 = load %struct.target*, %struct.target** %9
%165 = call i64 @dump_n_bytes_from_mem(i32 %161, i8** %163, %struct.target* %164, i32 256)
%166 = load i32, i32* %18
%167 = sext i32 %166 to i64
%168 = add nsw i64 %167, %165
%169 = trunc i64 %168 to i32
store i32 %169, i32* %18
%170 = load i32, i32* %16
%171 = load i8**, i8*** %10
%172 = getelementptr inbounds i8*, i8** %171, i64 5
%173 = load %struct.target*, %struct.target** %9
%174 = call i64 @dump_unsigned_int_from_mem(i32 %170, i8** %172, %struct.target* %173)
%175 = load i32, i32* %18
%176 = sext i32 %175 to i64
%177 = add nsw i64 %176, %174
%178 = trunc i64 %177 to i32
store i32 %178, i32* %18
%179 = load i32, i32* %17
%180 = load i8**, i8*** %10
%181 = getelementptr inbounds i8*, i8** %180, i64 6
%182 = load %struct.target*, %struct.target** %9
%183 = call i64 @dump_long_unsigned_int_from_mem(i32 %179, i8** %181, %struct.target* %182)
%184 = load i32, i32* %18
%185 = sext i32 %184 to i64
%186 = add nsw i64 %185, %183
%187 = trunc i64 %186 to i32
store i32 %187, i32* %18
br label %188
188: ; preds = %124, %121
%189 = load i8**, i8*** %10
%190 = call i8* @copy_params(i8** %189, i32 7, i32* %18)
%191 = load i8**, i8*** %8
store i8* %190, i8** %191
%192 = load i8**, i8*** %10
%193 = call i32 @free_dumped_params(i8** %192, i32 7)
%194 = load i32, i32* %18
store i32 %194, i32* %5
br label %195
195: ; preds = %188, %55, %34
%196 = load i32, i32* %5
ret i32 %196
}

LLVM IR (-O2):
%struct.target = type { i32 }
define i32 @dump___sysctl_args(i32 %0, i32 %1, i8** nocapture writeonly %2, %struct.target* %3) {
%5 = alloca i32
%6 = add i32 %1, 4
%7 = add i32 %1, 20
%8 = add i32 %1, 24
%9 = bitcast i32* %5 to i8*
store i32 0, i32* %5
%10 = icmp slt i32 %0, 0
br i1 %10, label %11, label %13
11: ; preds = %4
%12 = tail call i8* @malloc(i32 0)
store i8* %12, i8** %2
br label %82
13: ; preds = %4
%14 = add i32 %1, 16
%15 = add i32 %1, 12
%16 = add i32 %1, 8
%17 = tail call dereferenceable_or_null(56) i8* @malloc(i32 56)
%18 = bitcast i8* %17 to i8**
%19 = tail call i32 @read_ptr_from_mem(i32 %1, %struct.target* %3)
%20 = tail call i32 @read_ptr_from_mem(i32 %16, %struct.target* %3)
%21 = tail call i32 @read_ptr_from_mem(i32 %15, %struct.target* %3)
%22 = tail call i32 @read_ptr_from_mem(i32 %14, %struct.target* %3)
%23 = icmp eq i32 %0, 0
br i1 %23, label %24, label %53
24: ; preds = %13
%25 = tail call i64 @dump_ptr(i32 %19, i8** %18)
%26 = trunc i64 %25 to i32
%27 = getelementptr inbounds i8*, i8** %18, i64 1
%28 = tail call i64 @dump_int_from_mem(i32 %6, i8** %27, %struct.target* %3)
%29 = trunc i64 %28 to i32
%30 = add i32 %26, %29
%31 = getelementptr inbounds i8*, i8** %18, i64 2
%32 = tail call i64 @dump_ptr(i32 %20, i8** %31)
%33 = trunc i64 %32 to i32
%34 = add i32 %30, %33
%35 = getelementptr inbounds i8*, i8** %18, i64 3
%36 = tail call i64 @dump_ptr(i32 %21, i8** %35)
%37 = trunc i64 %36 to i32
%38 = add i32 %34, %37
%39 = getelementptr inbounds i8*, i8** %18, i64 4
%40 = tail call i64 @dump_ptr(i32 %22, i8** %39)
%41 = trunc i64 %40 to i32
%42 = add i32 %38, %41
%43 = getelementptr inbounds i8*, i8** %18, i64 5
%44 = tail call i64 @dump_unsigned_int_from_mem(i32 %7, i8** %43, %struct.target* %3)
%45 = trunc i64 %44 to i32
%46 = add i32 %42, %45
%47 = getelementptr inbounds i8*, i8** %18, i64 6
%48 = tail call i64 @dump_long_unsigned_int_from_mem(i32 %8, i8** %47, %struct.target* %3)
%49 = trunc i64 %48 to i32
%50 = add i32 %46, %49
store i32 %50, i32* %5
%51 = call i8* @copy_params(i8** %18, i32 7, i32* %5)
store i8* %51, i8** %2
%52 = call i32 @free_dumped_params(i8** %18, i32 7)
br label %82
53: ; preds = %13
%54 = tail call i64 @dump_int_from_mem(i32 %19, i8** %18, %struct.target* %3)
%55 = trunc i64 %54 to i32
%56 = getelementptr inbounds i8*, i8** %18, i64 1
%57 = tail call i64 @dump_int_from_mem(i32 %6, i8** %56, %struct.target* %3)
%58 = trunc i64 %57 to i32
%59 = add i32 %55, %58
%60 = getelementptr inbounds i8*, i8** %18, i64 2
%61 = tail call i64 @dump_n_bytes_from_mem(i32 %20, i8** %60, %struct.target* %3, i32 256)
%62 = trunc i64 %61 to i32
%63 = add i32 %59, %62
%64 = getelementptr inbounds i8*, i8** %18, i64 3
%65 = tail call i64 @dump_unsigned_int_from_mem(i32 %21, i8** %64, %struct.target* %3)
%66 = trunc i64 %65 to i32
%67 = add i32 %63, %66
%68 = getelementptr inbounds i8*, i8** %18, i64 4
%69 = tail call i64 @dump_n_bytes_from_mem(i32 %22, i8** %68, %struct.target* %3, i32 256)
%70 = trunc i64 %69 to i32
%71 = add i32 %67, %70
%72 = getelementptr inbounds i8*, i8** %18, i64 5
%73 = tail call i64 @dump_unsigned_int_from_mem(i32 %7, i8** %72, %struct.target* %3)
%74 = trunc i64 %73 to i32
%75 = add i32 %71, %74
%76 = getelementptr inbounds i8*, i8** %18, i64 6
%77 = tail call i64 @dump_long_unsigned_int_from_mem(i32 %8, i8** %76, %struct.target* %3)
%78 = trunc i64 %77 to i32
%79 = add i32 %75, %78
store i32 %79, i32* %5
%80 = call i8* @copy_params(i8** %18, i32 7, i32* %5)
store i8* %80, i8** %2
%81 = call i32 @free_dumped_params(i8** %18, i32 7)
br label %82
82: ; preds = %53, %24, %11
%83 = load i32, i32* %5
ret i32 %83
}