java -ea -Xmx8000000000 -jar /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/plugins/org.eclipse.equinox.launcher_1.3.100.v20150511-1540.jar -data @noDefault -ultimatedata /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data -tc ../../../trunk/examples/toolchains/AutomizerCInline_WitnessPrinter.xml -s ../../../trunk/examples/settings/default/automizer/svcomp-Reach-32bit-Automizer_Bitvector.epf -i ../../../trunk/examples/svcomp/ntdrivers-simplified/kbfiltr_simpl2_false-unreach-call_true-valid-memsafety_true-termination.cil.c -------------------------------------------------------------------------------- This is Ultimate 0.1.23-61f4311 [2018-11-23 10:48:30,999 INFO L170 SettingsManager]: Resetting all preferences to default values... [2018-11-23 10:48:31,001 INFO L174 SettingsManager]: Resetting UltimateCore preferences to default values [2018-11-23 10:48:31,017 INFO L177 SettingsManager]: Ultimate Commandline Interface provides no preferences, ignoring... [2018-11-23 10:48:31,018 INFO L174 SettingsManager]: Resetting Boogie Preprocessor preferences to default values [2018-11-23 10:48:31,019 INFO L174 SettingsManager]: Resetting Boogie Procedure Inliner preferences to default values [2018-11-23 10:48:31,020 INFO L174 SettingsManager]: Resetting Abstract Interpretation preferences to default values [2018-11-23 10:48:31,022 INFO L174 SettingsManager]: Resetting LassoRanker preferences to default values [2018-11-23 10:48:31,024 INFO L174 SettingsManager]: Resetting Reaching Definitions preferences to default values [2018-11-23 10:48:31,024 INFO L174 SettingsManager]: Resetting SyntaxChecker preferences to default values [2018-11-23 10:48:31,025 INFO L177 SettingsManager]: Büchi Program Product provides no preferences, ignoring... [2018-11-23 10:48:31,026 INFO L174 SettingsManager]: Resetting LTL2Aut preferences to default values [2018-11-23 10:48:31,027 INFO L174 SettingsManager]: Resetting PEA to Boogie preferences to default values [2018-11-23 10:48:31,028 INFO L174 SettingsManager]: Resetting BlockEncodingV2 preferences to default values [2018-11-23 10:48:31,029 INFO L174 SettingsManager]: Resetting ChcToBoogie preferences to default values [2018-11-23 10:48:31,030 INFO L174 SettingsManager]: Resetting AutomataScriptInterpreter preferences to default values [2018-11-23 10:48:31,031 INFO L174 SettingsManager]: Resetting BuchiAutomizer preferences to default values [2018-11-23 10:48:31,032 INFO L174 SettingsManager]: Resetting CACSL2BoogieTranslator preferences to default values [2018-11-23 10:48:31,034 INFO L174 SettingsManager]: Resetting CodeCheck preferences to default values [2018-11-23 10:48:31,036 INFO L174 SettingsManager]: Resetting InvariantSynthesis preferences to default values [2018-11-23 10:48:31,037 INFO L174 SettingsManager]: Resetting RCFGBuilder preferences to default values [2018-11-23 10:48:31,038 INFO L174 SettingsManager]: Resetting TraceAbstraction preferences to default values [2018-11-23 10:48:31,041 INFO L177 SettingsManager]: TraceAbstractionConcurrent provides no preferences, ignoring... [2018-11-23 10:48:31,041 INFO L177 SettingsManager]: TraceAbstractionWithAFAs provides no preferences, ignoring... [2018-11-23 10:48:31,041 INFO L174 SettingsManager]: Resetting TreeAutomizer preferences to default values [2018-11-23 10:48:31,042 INFO L174 SettingsManager]: Resetting IcfgTransformer preferences to default values [2018-11-23 10:48:31,043 INFO L174 SettingsManager]: Resetting Boogie Printer preferences to default values [2018-11-23 10:48:31,044 INFO L174 SettingsManager]: Resetting ReqPrinter preferences to default values [2018-11-23 10:48:31,045 INFO L174 SettingsManager]: Resetting Witness Printer preferences to default values [2018-11-23 10:48:31,046 INFO L177 SettingsManager]: Boogie PL CUP Parser provides no preferences, ignoring... [2018-11-23 10:48:31,046 INFO L174 SettingsManager]: Resetting CDTParser preferences to default values [2018-11-23 10:48:31,047 INFO L177 SettingsManager]: AutomataScriptParser provides no preferences, ignoring... [2018-11-23 10:48:31,047 INFO L177 SettingsManager]: ReqParser provides no preferences, ignoring... [2018-11-23 10:48:31,047 INFO L174 SettingsManager]: Resetting SmtParser preferences to default values [2018-11-23 10:48:31,049 INFO L174 SettingsManager]: Resetting Witness Parser preferences to default values [2018-11-23 10:48:31,049 INFO L181 SettingsManager]: Finished resetting all preferences to default values... [2018-11-23 10:48:31,050 INFO L98 SettingsManager]: Beginning loading settings from /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/../../../trunk/examples/settings/default/automizer/svcomp-Reach-32bit-Automizer_Bitvector.epf [2018-11-23 10:48:31,072 INFO L110 SettingsManager]: Loading preferences was successful [2018-11-23 10:48:31,072 INFO L112 SettingsManager]: Preferences different from defaults after loading the file: [2018-11-23 10:48:31,074 INFO L131 SettingsManager]: Preferences of Boogie Procedure Inliner differ from their defaults: [2018-11-23 10:48:31,074 INFO L133 SettingsManager]: * ... calls to implemented procedures=ONLY_FOR_CONCURRENT_PROGRAMS [2018-11-23 10:48:31,075 INFO L131 SettingsManager]: Preferences of BlockEncodingV2 differ from their defaults: [2018-11-23 10:48:31,077 INFO L133 SettingsManager]: * Create parallel compositions if possible=false [2018-11-23 10:48:31,077 INFO L133 SettingsManager]: * Use SBE=true [2018-11-23 10:48:31,077 INFO L131 SettingsManager]: Preferences of CACSL2BoogieTranslator differ from their defaults: [2018-11-23 10:48:31,078 INFO L133 SettingsManager]: * sizeof long=4 [2018-11-23 10:48:31,078 INFO L133 SettingsManager]: * sizeof POINTER=4 [2018-11-23 10:48:31,078 INFO L133 SettingsManager]: * Check division by zero=IGNORE [2018-11-23 10:48:31,078 INFO L133 SettingsManager]: * Pointer to allocated memory at dereference=IGNORE [2018-11-23 10:48:31,078 INFO L133 SettingsManager]: * If two pointers are subtracted or compared they have the same base address=IGNORE [2018-11-23 10:48:31,079 INFO L133 SettingsManager]: * Check array bounds for arrays that are off heap=IGNORE [2018-11-23 10:48:31,079 INFO L133 SettingsManager]: * Use bitvectors instead of ints=true [2018-11-23 10:48:31,079 INFO L133 SettingsManager]: * Memory model=HoenickeLindenmann_4ByteResolution [2018-11-23 10:48:31,079 INFO L133 SettingsManager]: * sizeof long double=12 [2018-11-23 10:48:31,080 INFO L133 SettingsManager]: * Check if freed pointer was valid=false [2018-11-23 10:48:31,080 INFO L133 SettingsManager]: * Use constant arrays=true [2018-11-23 10:48:31,080 INFO L133 SettingsManager]: * Pointer base address is valid at dereference=IGNORE [2018-11-23 10:48:31,080 INFO L131 SettingsManager]: Preferences of RCFGBuilder differ from their defaults: [2018-11-23 10:48:31,080 INFO L133 SettingsManager]: * Size of a code block=SequenceOfStatements [2018-11-23 10:48:31,082 INFO L133 SettingsManager]: * To the following directory=./dump/ [2018-11-23 10:48:31,082 INFO L133 SettingsManager]: * SMT solver=External_DefaultMode [2018-11-23 10:48:31,082 INFO L133 SettingsManager]: * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2018-11-23 10:48:31,082 INFO L131 SettingsManager]: Preferences of TraceAbstraction differ from their defaults: [2018-11-23 10:48:31,082 INFO L133 SettingsManager]: * Compute Interpolants along a Counterexample=FPandBP [2018-11-23 10:48:31,082 INFO L133 SettingsManager]: * Positions where we compute the Hoare Annotation=LoopsAndPotentialCycles [2018-11-23 10:48:31,083 INFO L133 SettingsManager]: * Trace refinement strategy=WOLF [2018-11-23 10:48:31,083 INFO L133 SettingsManager]: * SMT solver=External_ModelsAndUnsatCoreMode [2018-11-23 10:48:31,083 INFO L133 SettingsManager]: * Command for external solver=cvc4nyu --tear-down-incremental --rewrite-divk --print-success --lang smt [2018-11-23 10:48:31,083 INFO L133 SettingsManager]: * Logic for external solver=AUFBV [2018-11-23 10:48:31,083 INFO L133 SettingsManager]: * Compute Hoare Annotation of negated interpolant automaton, abstraction and CFG=true [2018-11-23 10:48:31,139 INFO L81 nceAwareModelManager]: Repository-Root is: /tmp [2018-11-23 10:48:31,155 INFO L258 ainManager$Toolchain]: [Toolchain 1]: Applicable parser(s) successfully (re)initialized [2018-11-23 10:48:31,159 INFO L214 ainManager$Toolchain]: [Toolchain 1]: Toolchain selected. [2018-11-23 10:48:31,161 INFO L271 PluginConnector]: Initializing CDTParser... [2018-11-23 10:48:31,161 INFO L276 PluginConnector]: CDTParser initialized [2018-11-23 10:48:31,162 INFO L418 ainManager$Toolchain]: [Toolchain 1]: Parsing single file: /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/../../../trunk/examples/svcomp/ntdrivers-simplified/kbfiltr_simpl2_false-unreach-call_true-valid-memsafety_true-termination.cil.c [2018-11-23 10:48:31,226 INFO L221 CDTParser]: Created temporary CDT project at /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/c9fcdb348/b328f65efac541ab85499117cb01a7a3/FLAGe5161c0d6 [2018-11-23 10:48:31,740 INFO L307 CDTParser]: Found 1 translation units. [2018-11-23 10:48:31,741 INFO L161 CDTParser]: Scanning /storage/repos/ultimate/trunk/examples/svcomp/ntdrivers-simplified/kbfiltr_simpl2_false-unreach-call_true-valid-memsafety_true-termination.cil.c [2018-11-23 10:48:31,758 INFO L355 CDTParser]: About to delete temporary CDT project at /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/c9fcdb348/b328f65efac541ab85499117cb01a7a3/FLAGe5161c0d6 [2018-11-23 10:48:32,054 INFO L363 CDTParser]: Successfully deleted /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/c9fcdb348/b328f65efac541ab85499117cb01a7a3 [2018-11-23 10:48:32,065 INFO L296 ainManager$Toolchain]: ####################### [Toolchain 1] ####################### [2018-11-23 10:48:32,066 INFO L131 ToolchainWalker]: Walking toolchain with 6 elements. [2018-11-23 10:48:32,068 INFO L113 PluginConnector]: ------------------------CACSL2BoogieTranslator---------------------------- [2018-11-23 10:48:32,069 INFO L271 PluginConnector]: Initializing CACSL2BoogieTranslator... [2018-11-23 10:48:32,074 INFO L276 PluginConnector]: CACSL2BoogieTranslator initialized [2018-11-23 10:48:32,075 INFO L185 PluginConnector]: Executing the observer ACSLObjectContainerObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 23.11 10:48:32" (1/1) ... [2018-11-23 10:48:32,078 INFO L205 PluginConnector]: Invalid model from CACSL2BoogieTranslator for observer de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator.ACSLObjectContainerObserver@7d0be90c and model type de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 10:48:32, skipping insertion in model container [2018-11-23 10:48:32,079 INFO L185 PluginConnector]: Executing the observer CACSL2BoogieTranslatorObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 23.11 10:48:32" (1/1) ... [2018-11-23 10:48:32,089 INFO L145 MainTranslator]: Starting translation in SV-COMP mode [2018-11-23 10:48:32,166 INFO L176 MainTranslator]: Built tables and reachable declarations [2018-11-23 10:48:32,549 INFO L201 PostProcessor]: Analyzing one entry point: main [2018-11-23 10:48:32,556 INFO L191 MainTranslator]: Completed pre-run [2018-11-23 10:48:32,697 INFO L201 PostProcessor]: Analyzing one entry point: main [2018-11-23 10:48:32,719 INFO L195 MainTranslator]: Completed translation [2018-11-23 10:48:32,720 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 10:48:32 WrapperNode [2018-11-23 10:48:32,720 INFO L132 PluginConnector]: ------------------------ END CACSL2BoogieTranslator---------------------------- [2018-11-23 10:48:32,721 INFO L113 PluginConnector]: ------------------------Boogie Procedure Inliner---------------------------- [2018-11-23 10:48:32,721 INFO L271 PluginConnector]: Initializing Boogie Procedure Inliner... [2018-11-23 10:48:32,721 INFO L276 PluginConnector]: Boogie Procedure Inliner initialized [2018-11-23 10:48:32,729 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 10:48:32" (1/1) ... [2018-11-23 10:48:32,746 INFO L185 PluginConnector]: Executing the observer Inliner from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 10:48:32" (1/1) ... [2018-11-23 10:48:32,843 INFO L132 PluginConnector]: ------------------------ END Boogie Procedure Inliner---------------------------- [2018-11-23 10:48:32,844 INFO L113 PluginConnector]: ------------------------Boogie Preprocessor---------------------------- [2018-11-23 10:48:32,844 INFO L271 PluginConnector]: Initializing Boogie Preprocessor... [2018-11-23 10:48:32,844 INFO L276 PluginConnector]: Boogie Preprocessor initialized [2018-11-23 10:48:32,855 INFO L185 PluginConnector]: Executing the observer EnsureBoogieModelObserver from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 10:48:32" (1/1) ... [2018-11-23 10:48:32,855 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 10:48:32" (1/1) ... [2018-11-23 10:48:32,865 INFO L185 PluginConnector]: Executing the observer ConstExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 10:48:32" (1/1) ... [2018-11-23 10:48:32,866 INFO L185 PluginConnector]: Executing the observer StructExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 10:48:32" (1/1) ... [2018-11-23 10:48:32,927 INFO L185 PluginConnector]: Executing the observer UnstructureCode from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 10:48:32" (1/1) ... [2018-11-23 10:48:32,941 INFO L185 PluginConnector]: Executing the observer FunctionInliner from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 10:48:32" (1/1) ... [2018-11-23 10:48:32,945 INFO L185 PluginConnector]: Executing the observer BoogieSymbolTableConstructor from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 10:48:32" (1/1) ... [2018-11-23 10:48:32,951 INFO L132 PluginConnector]: ------------------------ END Boogie Preprocessor---------------------------- [2018-11-23 10:48:32,952 INFO L113 PluginConnector]: ------------------------RCFGBuilder---------------------------- [2018-11-23 10:48:32,952 INFO L271 PluginConnector]: Initializing RCFGBuilder... [2018-11-23 10:48:32,952 INFO L276 PluginConnector]: RCFGBuilder initialized [2018-11-23 10:48:32,953 INFO L185 PluginConnector]: Executing the observer RCFGBuilderObserver from plugin RCFGBuilder for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 10:48:32" (1/1) ... No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 Starting monitored process 1 with z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 1 with z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2018-11-23 10:48:33,019 INFO L130 BoogieDeclarations]: Found specification of procedure KeSetEvent [2018-11-23 10:48:33,020 INFO L138 BoogieDeclarations]: Found implementation of procedure KeSetEvent [2018-11-23 10:48:33,020 INFO L130 BoogieDeclarations]: Found specification of procedure KbFilter_Complete [2018-11-23 10:48:33,020 INFO L138 BoogieDeclarations]: Found implementation of procedure KbFilter_Complete [2018-11-23 10:48:33,020 INFO L130 BoogieDeclarations]: Found specification of procedure KbFilter_Power [2018-11-23 10:48:33,020 INFO L138 BoogieDeclarations]: Found implementation of procedure KbFilter_Power [2018-11-23 10:48:33,020 INFO L130 BoogieDeclarations]: Found specification of procedure stub_driver_init [2018-11-23 10:48:33,021 INFO L138 BoogieDeclarations]: Found implementation of procedure stub_driver_init [2018-11-23 10:48:33,021 INFO L130 BoogieDeclarations]: Found specification of procedure _BLAST_init [2018-11-23 10:48:33,021 INFO L138 BoogieDeclarations]: Found implementation of procedure _BLAST_init [2018-11-23 10:48:33,021 INFO L130 BoogieDeclarations]: Found specification of procedure errorFn [2018-11-23 10:48:33,021 INFO L138 BoogieDeclarations]: Found implementation of procedure errorFn [2018-11-23 10:48:33,022 INFO L130 BoogieDeclarations]: Found specification of procedure main [2018-11-23 10:48:33,022 INFO L138 BoogieDeclarations]: Found implementation of procedure main [2018-11-23 10:48:33,022 INFO L130 BoogieDeclarations]: Found specification of procedure IofCallDriver [2018-11-23 10:48:33,022 INFO L138 BoogieDeclarations]: Found implementation of procedure IofCallDriver [2018-11-23 10:48:33,022 INFO L130 BoogieDeclarations]: Found specification of procedure stubMoreProcessingRequired [2018-11-23 10:48:33,022 INFO L138 BoogieDeclarations]: Found implementation of procedure stubMoreProcessingRequired [2018-11-23 10:48:33,023 INFO L130 BoogieDeclarations]: Found specification of procedure PoCallDriver [2018-11-23 10:48:33,023 INFO L138 BoogieDeclarations]: Found implementation of procedure PoCallDriver [2018-11-23 10:48:33,023 INFO L130 BoogieDeclarations]: Found specification of procedure KbFilter_CreateClose [2018-11-23 10:48:33,023 INFO L138 BoogieDeclarations]: Found implementation of procedure KbFilter_CreateClose [2018-11-23 10:48:33,024 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.init [2018-11-23 10:48:33,024 INFO L138 BoogieDeclarations]: Found implementation of procedure ULTIMATE.init [2018-11-23 10:48:33,024 INFO L130 BoogieDeclarations]: Found specification of procedure KbFilter_InternIoCtl [2018-11-23 10:48:33,024 INFO L138 BoogieDeclarations]: Found implementation of procedure KbFilter_InternIoCtl [2018-11-23 10:48:33,024 INFO L130 BoogieDeclarations]: Found specification of procedure KeWaitForSingleObject [2018-11-23 10:48:33,024 INFO L138 BoogieDeclarations]: Found implementation of procedure KeWaitForSingleObject [2018-11-23 10:48:33,025 INFO L130 BoogieDeclarations]: Found specification of procedure IofCompleteRequest [2018-11-23 10:48:33,025 INFO L138 BoogieDeclarations]: Found implementation of procedure IofCompleteRequest [2018-11-23 10:48:33,025 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.start [2018-11-23 10:48:33,025 INFO L138 BoogieDeclarations]: Found implementation of procedure ULTIMATE.start [2018-11-23 10:48:33,025 INFO L130 BoogieDeclarations]: Found specification of procedure KbFilter_DispatchPassThrough [2018-11-23 10:48:33,025 INFO L138 BoogieDeclarations]: Found implementation of procedure KbFilter_DispatchPassThrough [2018-11-23 10:48:33,026 INFO L130 BoogieDeclarations]: Found specification of procedure KbFilter_PnP [2018-11-23 10:48:33,026 INFO L138 BoogieDeclarations]: Found implementation of procedure KbFilter_PnP [2018-11-23 10:48:33,395 WARN L640 $ProcedureCfgBuilder]: Two Gotos in a row! There was dead code [2018-11-23 10:48:33,395 WARN L605 $ProcedureCfgBuilder]: Label in the middle of a codeblock. [2018-11-23 10:48:33,720 WARN L640 $ProcedureCfgBuilder]: Two Gotos in a row! There was dead code [2018-11-23 10:48:33,721 WARN L605 $ProcedureCfgBuilder]: Label in the middle of a codeblock. [2018-11-23 10:48:34,220 WARN L640 $ProcedureCfgBuilder]: Two Gotos in a row! There was dead code [2018-11-23 10:48:34,220 WARN L605 $ProcedureCfgBuilder]: Label in the middle of a codeblock. [2018-11-23 10:48:34,339 WARN L640 $ProcedureCfgBuilder]: Two Gotos in a row! There was dead code [2018-11-23 10:48:34,339 WARN L605 $ProcedureCfgBuilder]: Label in the middle of a codeblock. [2018-11-23 10:48:35,056 WARN L640 $ProcedureCfgBuilder]: Two Gotos in a row! There was dead code [2018-11-23 10:48:35,056 WARN L605 $ProcedureCfgBuilder]: Label in the middle of a codeblock. [2018-11-23 10:48:35,152 WARN L640 $ProcedureCfgBuilder]: Two Gotos in a row! There was dead code [2018-11-23 10:48:35,152 WARN L605 $ProcedureCfgBuilder]: Label in the middle of a codeblock. [2018-11-23 10:48:35,991 INFO L275 CfgBuilder]: Using the 1 location(s) as analysis (start of procedure ULTIMATE.start) [2018-11-23 10:48:35,992 INFO L280 CfgBuilder]: Removed 0 assue(true) statements. [2018-11-23 10:48:35,992 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 23.11 10:48:35 BoogieIcfgContainer [2018-11-23 10:48:35,992 INFO L132 PluginConnector]: ------------------------ END RCFGBuilder---------------------------- [2018-11-23 10:48:35,993 INFO L113 PluginConnector]: ------------------------TraceAbstraction---------------------------- [2018-11-23 10:48:35,994 INFO L271 PluginConnector]: Initializing TraceAbstraction... [2018-11-23 10:48:35,997 INFO L276 PluginConnector]: TraceAbstraction initialized [2018-11-23 10:48:35,998 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "CDTParser AST 23.11 10:48:32" (1/3) ... [2018-11-23 10:48:35,998 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@7d486fa1 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 23.11 10:48:35, skipping insertion in model container [2018-11-23 10:48:35,999 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 10:48:32" (2/3) ... [2018-11-23 10:48:35,999 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@7d486fa1 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 23.11 10:48:35, skipping insertion in model container [2018-11-23 10:48:35,999 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 23.11 10:48:35" (3/3) ... [2018-11-23 10:48:36,001 INFO L112 eAbstractionObserver]: Analyzing ICFG kbfiltr_simpl2_false-unreach-call_true-valid-memsafety_true-termination.cil.c [2018-11-23 10:48:36,012 INFO L156 ceAbstractionStarter]: Automizer settings: Hoare:true NWA Interpolation:FPandBP Determinization: PREDICATE_ABSTRACTION [2018-11-23 10:48:36,021 INFO L168 ceAbstractionStarter]: Appying trace abstraction to program that has 1 error locations. [2018-11-23 10:48:36,039 INFO L257 AbstractCegarLoop]: Starting to check reachability of 1 error locations. [2018-11-23 10:48:36,076 INFO L133 ementStrategyFactory]: Using default assertion order modulation [2018-11-23 10:48:36,076 INFO L382 AbstractCegarLoop]: Interprodecural is true [2018-11-23 10:48:36,077 INFO L383 AbstractCegarLoop]: Hoare is true [2018-11-23 10:48:36,077 INFO L384 AbstractCegarLoop]: Compute interpolants for FPandBP [2018-11-23 10:48:36,077 INFO L385 AbstractCegarLoop]: Backedges is STRAIGHT_LINE [2018-11-23 10:48:36,077 INFO L386 AbstractCegarLoop]: Determinization is PREDICATE_ABSTRACTION [2018-11-23 10:48:36,077 INFO L387 AbstractCegarLoop]: Difference is false [2018-11-23 10:48:36,078 INFO L388 AbstractCegarLoop]: Minimize is MINIMIZE_SEVPA [2018-11-23 10:48:36,078 INFO L393 AbstractCegarLoop]: ======== Iteration 0==of CEGAR loop == AllErrorsAtOnce======== [2018-11-23 10:48:36,107 INFO L276 IsEmpty]: Start isEmpty. Operand 240 states. [2018-11-23 10:48:36,115 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 21 [2018-11-23 10:48:36,115 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 10:48:36,116 INFO L402 BasicCegarLoop]: trace histogram [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 10:48:36,120 INFO L423 AbstractCegarLoop]: === Iteration 1 === [errorFnErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 10:48:36,129 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 10:48:36,129 INFO L82 PathProgramCache]: Analyzing trace with hash -1129426977, now seen corresponding path program 1 times [2018-11-23 10:48:36,134 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 10:48:36,135 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/cvc4nyu Starting monitored process 2 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 2 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 10:48:36,160 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 10:48:36,259 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:48:36,311 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:48:36,317 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 10:48:36,474 INFO L256 TraceCheckUtils]: 0: Hoare triple {243#true} call ULTIMATE.init(); {243#true} is VALID [2018-11-23 10:48:36,479 INFO L273 TraceCheckUtils]: 1: Hoare triple {243#true} ~KernelMode~0 := 0bv32;~Executive~0 := 0bv32;~DevicePowerState~0 := 0bv32;~s~0 := 0bv32;~UNLOADED~0 := 0bv32;~NP~0 := 0bv32;~DC~0 := 0bv32;~SKIP1~0 := 0bv32;~SKIP2~0 := 0bv32;~MPR1~0 := 0bv32;~MPR3~0 := 0bv32;~IPC~0 := 0bv32;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32;~myStatus~0 := 0bv32; {243#true} is VALID [2018-11-23 10:48:36,479 INFO L273 TraceCheckUtils]: 2: Hoare triple {243#true} assume true; {243#true} is VALID [2018-11-23 10:48:36,480 INFO L268 TraceCheckUtils]: 3: Hoare quadruple {243#true} {243#true} #759#return; {243#true} is VALID [2018-11-23 10:48:36,480 INFO L256 TraceCheckUtils]: 4: Hoare triple {243#true} call #t~ret77 := main(); {243#true} is VALID [2018-11-23 10:48:36,480 INFO L273 TraceCheckUtils]: 5: Hoare triple {243#true} havoc ~status~1;~irp~0 := #t~nondet17;havoc #t~nondet17;havoc ~pirp~0;havoc ~pirp__IoStatus__Status~0;~irp_choice~0 := #t~nondet18;havoc #t~nondet18;~devobj~0 := #t~nondet19;havoc #t~nondet19;havoc ~__cil_tmp8~0;~KernelMode~0 := 0bv32;~Executive~0 := 0bv32;~DevicePowerState~0 := 1bv32;~s~0 := 0bv32;~UNLOADED~0 := 0bv32;~NP~0 := 0bv32;~DC~0 := 0bv32;~SKIP1~0 := 0bv32;~SKIP2~0 := 0bv32;~MPR1~0 := 0bv32;~MPR3~0 := 0bv32;~IPC~0 := 0bv32;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32;~myStatus~0 := 0bv32;~status~1 := 0bv32;~pirp~0 := ~irp~0; {243#true} is VALID [2018-11-23 10:48:36,481 INFO L256 TraceCheckUtils]: 6: Hoare triple {243#true} call _BLAST_init(); {243#true} is VALID [2018-11-23 10:48:36,497 INFO L273 TraceCheckUtils]: 7: Hoare triple {243#true} ~UNLOADED~0 := 0bv32;~NP~0 := 1bv32;~DC~0 := 2bv32;~SKIP1~0 := 3bv32;~SKIP2~0 := 4bv32;~MPR1~0 := 5bv32;~MPR3~0 := 6bv32;~IPC~0 := 7bv32;~s~0 := ~UNLOADED~0;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32; {269#(= ~UNLOADED~0 ~s~0)} is VALID [2018-11-23 10:48:36,498 INFO L273 TraceCheckUtils]: 8: Hoare triple {269#(= ~UNLOADED~0 ~s~0)} assume true; {269#(= ~UNLOADED~0 ~s~0)} is VALID [2018-11-23 10:48:36,502 INFO L268 TraceCheckUtils]: 9: Hoare quadruple {269#(= ~UNLOADED~0 ~s~0)} {243#true} #717#return; {269#(= ~UNLOADED~0 ~s~0)} is VALID [2018-11-23 10:48:36,503 INFO L273 TraceCheckUtils]: 10: Hoare triple {269#(= ~UNLOADED~0 ~s~0)} assume !~bvsge32(~status~1, 0bv32); {269#(= ~UNLOADED~0 ~s~0)} is VALID [2018-11-23 10:48:36,505 INFO L273 TraceCheckUtils]: 11: Hoare triple {269#(= ~UNLOADED~0 ~s~0)} assume !(1bv32 == ~pended~0); {269#(= ~UNLOADED~0 ~s~0)} is VALID [2018-11-23 10:48:36,507 INFO L273 TraceCheckUtils]: 12: Hoare triple {269#(= ~UNLOADED~0 ~s~0)} assume !(1bv32 == ~pended~0); {269#(= ~UNLOADED~0 ~s~0)} is VALID [2018-11-23 10:48:36,510 INFO L273 TraceCheckUtils]: 13: Hoare triple {269#(= ~UNLOADED~0 ~s~0)} assume ~s~0 != ~UNLOADED~0; {244#false} is VALID [2018-11-23 10:48:36,510 INFO L273 TraceCheckUtils]: 14: Hoare triple {244#false} assume 4294967295bv32 != ~status~1; {244#false} is VALID [2018-11-23 10:48:36,510 INFO L273 TraceCheckUtils]: 15: Hoare triple {244#false} assume !(~s~0 != ~SKIP2~0); {244#false} is VALID [2018-11-23 10:48:36,511 INFO L273 TraceCheckUtils]: 16: Hoare triple {244#false} assume 1bv32 == ~pended~0; {244#false} is VALID [2018-11-23 10:48:36,511 INFO L273 TraceCheckUtils]: 17: Hoare triple {244#false} assume 259bv32 != ~status~1; {244#false} is VALID [2018-11-23 10:48:36,511 INFO L256 TraceCheckUtils]: 18: Hoare triple {244#false} call errorFn(); {244#false} is VALID [2018-11-23 10:48:36,512 INFO L273 TraceCheckUtils]: 19: Hoare triple {244#false} assume !false; {244#false} is VALID [2018-11-23 10:48:36,517 INFO L134 CoverageAnalysis]: Checked inductivity of 0 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 0 trivial. 0 not checked. [2018-11-23 10:48:36,517 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-23 10:48:36,525 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 10:48:36,525 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-23 10:48:36,531 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 20 [2018-11-23 10:48:36,534 INFO L84 Accepts]: Finished accepts. word is accepted. [2018-11-23 10:48:36,542 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 3 states. [2018-11-23 10:48:36,629 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 20 edges. 20 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:48:36,629 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-23 10:48:36,637 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-23 10:48:36,637 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 10:48:36,640 INFO L87 Difference]: Start difference. First operand 240 states. Second operand 3 states. [2018-11-23 10:48:38,278 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:48:38,279 INFO L93 Difference]: Finished difference Result 397 states and 597 transitions. [2018-11-23 10:48:38,279 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-23 10:48:38,279 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 20 [2018-11-23 10:48:38,280 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 10:48:38,281 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 3 states. [2018-11-23 10:48:38,315 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 3 states to 3 states and 597 transitions. [2018-11-23 10:48:38,315 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 3 states. [2018-11-23 10:48:38,337 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 3 states to 3 states and 597 transitions. [2018-11-23 10:48:38,337 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 3 states and 597 transitions. [2018-11-23 10:48:39,604 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 597 edges. 597 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:48:39,647 INFO L225 Difference]: With dead ends: 397 [2018-11-23 10:48:39,647 INFO L226 Difference]: Without dead ends: 231 [2018-11-23 10:48:39,655 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 19 GetRequests, 18 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 10:48:39,680 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 231 states. [2018-11-23 10:48:39,859 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 231 to 231. [2018-11-23 10:48:39,859 INFO L214 AbstractMinimizeNwa]: Start testing correctness of minimizeSevpa [2018-11-23 10:48:39,860 INFO L82 GeneralOperation]: Start isEquivalent. First operand 231 states. Second operand 231 states. [2018-11-23 10:48:39,861 INFO L74 IsIncluded]: Start isIncluded. First operand 231 states. Second operand 231 states. [2018-11-23 10:48:39,861 INFO L87 Difference]: Start difference. First operand 231 states. Second operand 231 states. [2018-11-23 10:48:39,880 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:48:39,880 INFO L93 Difference]: Finished difference Result 231 states and 326 transitions. [2018-11-23 10:48:39,880 INFO L276 IsEmpty]: Start isEmpty. Operand 231 states and 326 transitions. [2018-11-23 10:48:39,885 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:48:39,885 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:48:39,885 INFO L74 IsIncluded]: Start isIncluded. First operand 231 states. Second operand 231 states. [2018-11-23 10:48:39,886 INFO L87 Difference]: Start difference. First operand 231 states. Second operand 231 states. [2018-11-23 10:48:39,902 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:48:39,902 INFO L93 Difference]: Finished difference Result 231 states and 326 transitions. [2018-11-23 10:48:39,903 INFO L276 IsEmpty]: Start isEmpty. Operand 231 states and 326 transitions. [2018-11-23 10:48:39,906 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:48:39,906 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:48:39,906 INFO L88 GeneralOperation]: Finished isEquivalent. [2018-11-23 10:48:39,906 INFO L221 AbstractMinimizeNwa]: Finished testing correctness of minimizeSevpa [2018-11-23 10:48:39,907 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 231 states. [2018-11-23 10:48:39,920 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 231 states to 231 states and 326 transitions. [2018-11-23 10:48:39,923 INFO L78 Accepts]: Start accepts. Automaton has 231 states and 326 transitions. Word has length 20 [2018-11-23 10:48:39,923 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 10:48:39,923 INFO L480 AbstractCegarLoop]: Abstraction has 231 states and 326 transitions. [2018-11-23 10:48:39,924 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-23 10:48:39,924 INFO L276 IsEmpty]: Start isEmpty. Operand 231 states and 326 transitions. [2018-11-23 10:48:39,925 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 29 [2018-11-23 10:48:39,926 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 10:48:39,926 INFO L402 BasicCegarLoop]: trace histogram [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 10:48:39,926 INFO L423 AbstractCegarLoop]: === Iteration 2 === [errorFnErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 10:48:39,927 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 10:48:39,927 INFO L82 PathProgramCache]: Analyzing trace with hash 1811427322, now seen corresponding path program 1 times [2018-11-23 10:48:39,928 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 10:48:39,928 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/cvc4nyu Starting monitored process 3 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 3 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 10:48:39,953 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 10:48:40,047 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:48:40,099 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:48:40,102 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 10:48:40,329 INFO L256 TraceCheckUtils]: 0: Hoare triple {1620#true} call ULTIMATE.init(); {1620#true} is VALID [2018-11-23 10:48:40,329 INFO L273 TraceCheckUtils]: 1: Hoare triple {1620#true} ~KernelMode~0 := 0bv32;~Executive~0 := 0bv32;~DevicePowerState~0 := 0bv32;~s~0 := 0bv32;~UNLOADED~0 := 0bv32;~NP~0 := 0bv32;~DC~0 := 0bv32;~SKIP1~0 := 0bv32;~SKIP2~0 := 0bv32;~MPR1~0 := 0bv32;~MPR3~0 := 0bv32;~IPC~0 := 0bv32;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32;~myStatus~0 := 0bv32; {1620#true} is VALID [2018-11-23 10:48:40,329 INFO L273 TraceCheckUtils]: 2: Hoare triple {1620#true} assume true; {1620#true} is VALID [2018-11-23 10:48:40,330 INFO L268 TraceCheckUtils]: 3: Hoare quadruple {1620#true} {1620#true} #759#return; {1620#true} is VALID [2018-11-23 10:48:40,330 INFO L256 TraceCheckUtils]: 4: Hoare triple {1620#true} call #t~ret77 := main(); {1620#true} is VALID [2018-11-23 10:48:40,330 INFO L273 TraceCheckUtils]: 5: Hoare triple {1620#true} havoc ~status~1;~irp~0 := #t~nondet17;havoc #t~nondet17;havoc ~pirp~0;havoc ~pirp__IoStatus__Status~0;~irp_choice~0 := #t~nondet18;havoc #t~nondet18;~devobj~0 := #t~nondet19;havoc #t~nondet19;havoc ~__cil_tmp8~0;~KernelMode~0 := 0bv32;~Executive~0 := 0bv32;~DevicePowerState~0 := 1bv32;~s~0 := 0bv32;~UNLOADED~0 := 0bv32;~NP~0 := 0bv32;~DC~0 := 0bv32;~SKIP1~0 := 0bv32;~SKIP2~0 := 0bv32;~MPR1~0 := 0bv32;~MPR3~0 := 0bv32;~IPC~0 := 0bv32;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32;~myStatus~0 := 0bv32;~status~1 := 0bv32;~pirp~0 := ~irp~0; {1620#true} is VALID [2018-11-23 10:48:40,331 INFO L256 TraceCheckUtils]: 6: Hoare triple {1620#true} call _BLAST_init(); {1620#true} is VALID [2018-11-23 10:48:40,331 INFO L273 TraceCheckUtils]: 7: Hoare triple {1620#true} ~UNLOADED~0 := 0bv32;~NP~0 := 1bv32;~DC~0 := 2bv32;~SKIP1~0 := 3bv32;~SKIP2~0 := 4bv32;~MPR1~0 := 5bv32;~MPR3~0 := 6bv32;~IPC~0 := 7bv32;~s~0 := ~UNLOADED~0;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32; {1620#true} is VALID [2018-11-23 10:48:40,331 INFO L273 TraceCheckUtils]: 8: Hoare triple {1620#true} assume true; {1620#true} is VALID [2018-11-23 10:48:40,331 INFO L268 TraceCheckUtils]: 9: Hoare quadruple {1620#true} {1620#true} #717#return; {1620#true} is VALID [2018-11-23 10:48:40,332 INFO L273 TraceCheckUtils]: 10: Hoare triple {1620#true} assume ~bvsge32(~status~1, 0bv32);~s~0 := ~NP~0;~customIrp~0 := 0bv32;~setEventCalled~0 := ~customIrp~0;~lowerDriverReturn~0 := ~setEventCalled~0;~compRegistered~0 := ~lowerDriverReturn~0;~pended~0 := ~compRegistered~0;~pirp__IoStatus__Status~0 := 0bv32;~myStatus~0 := 0bv32; {1620#true} is VALID [2018-11-23 10:48:40,332 INFO L273 TraceCheckUtils]: 11: Hoare triple {1620#true} assume !(0bv32 == ~irp_choice~0); {1620#true} is VALID [2018-11-23 10:48:40,332 INFO L256 TraceCheckUtils]: 12: Hoare triple {1620#true} call stub_driver_init(); {1620#true} is VALID [2018-11-23 10:48:40,337 INFO L273 TraceCheckUtils]: 13: Hoare triple {1620#true} ~s~0 := ~NP~0;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32; {1664#(= ~NP~0 ~s~0)} is VALID [2018-11-23 10:48:40,338 INFO L273 TraceCheckUtils]: 14: Hoare triple {1664#(= ~NP~0 ~s~0)} assume true; {1664#(= ~NP~0 ~s~0)} is VALID [2018-11-23 10:48:40,338 INFO L268 TraceCheckUtils]: 15: Hoare quadruple {1664#(= ~NP~0 ~s~0)} {1620#true} #719#return; {1664#(= ~NP~0 ~s~0)} is VALID [2018-11-23 10:48:40,339 INFO L273 TraceCheckUtils]: 16: Hoare triple {1664#(= ~NP~0 ~s~0)} assume !~bvslt32(~status~1, 0bv32);havoc ~tmp_ndt_1~0;~tmp_ndt_1~0 := #t~nondet20;havoc #t~nondet20; {1664#(= ~NP~0 ~s~0)} is VALID [2018-11-23 10:48:40,339 INFO L273 TraceCheckUtils]: 17: Hoare triple {1664#(= ~NP~0 ~s~0)} assume 0bv32 == ~tmp_ndt_1~0; {1664#(= ~NP~0 ~s~0)} is VALID [2018-11-23 10:48:40,340 INFO L256 TraceCheckUtils]: 18: Hoare triple {1664#(= ~NP~0 ~s~0)} call #t~ret25 := KbFilter_CreateClose(~devobj~0, ~pirp~0); {1664#(= ~NP~0 ~s~0)} is VALID [2018-11-23 10:48:40,341 INFO L273 TraceCheckUtils]: 19: Hoare triple {1664#(= ~NP~0 ~s~0)} ~DeviceObject := #in~DeviceObject;~Irp := #in~Irp;~irpStack__MajorFunction~0 := #t~nondet37;havoc #t~nondet37;~devExt__UpperConnectData__ClassService~0 := #t~nondet38;havoc #t~nondet38;havoc ~Irp__IoStatus__Status~1;havoc ~status~2;havoc ~tmp~0;~status~2 := ~myStatus~0; {1664#(= ~NP~0 ~s~0)} is VALID [2018-11-23 10:48:40,341 INFO L273 TraceCheckUtils]: 20: Hoare triple {1664#(= ~NP~0 ~s~0)} assume 0bv32 == ~irpStack__MajorFunction~0; {1664#(= ~NP~0 ~s~0)} is VALID [2018-11-23 10:48:40,342 INFO L273 TraceCheckUtils]: 21: Hoare triple {1664#(= ~NP~0 ~s~0)} assume 0bv32 == ~devExt__UpperConnectData__ClassService~0;~status~2 := 3221225860bv32; {1664#(= ~NP~0 ~s~0)} is VALID [2018-11-23 10:48:40,343 INFO L273 TraceCheckUtils]: 22: Hoare triple {1664#(= ~NP~0 ~s~0)} ~Irp__IoStatus__Status~1 := ~status~2;~myStatus~0 := ~status~2; {1664#(= ~NP~0 ~s~0)} is VALID [2018-11-23 10:48:40,344 INFO L256 TraceCheckUtils]: 23: Hoare triple {1664#(= ~NP~0 ~s~0)} call #t~ret39 := KbFilter_DispatchPassThrough(~DeviceObject, ~Irp); {1664#(= ~NP~0 ~s~0)} is VALID [2018-11-23 10:48:40,346 INFO L273 TraceCheckUtils]: 24: Hoare triple {1664#(= ~NP~0 ~s~0)} ~DeviceObject := #in~DeviceObject;~Irp := #in~Irp;~Irp__Tail__Overlay__CurrentStackLocation~1 := #t~nondet40;havoc #t~nondet40;~Irp__CurrentLocation~1 := #t~nondet41;havoc #t~nondet41;~DeviceObject__DeviceExtension__TopOfStack~0 := #t~nondet42;havoc #t~nondet42;havoc ~irpStack~1;havoc ~tmp~1;~irpStack~1 := ~Irp__Tail__Overlay__CurrentStackLocation~1; {1664#(= ~NP~0 ~s~0)} is VALID [2018-11-23 10:48:40,347 INFO L273 TraceCheckUtils]: 25: Hoare triple {1664#(= ~NP~0 ~s~0)} assume !(~s~0 == ~NP~0); {1621#false} is VALID [2018-11-23 10:48:40,348 INFO L256 TraceCheckUtils]: 26: Hoare triple {1621#false} call errorFn(); {1621#false} is VALID [2018-11-23 10:48:40,348 INFO L273 TraceCheckUtils]: 27: Hoare triple {1621#false} assume !false; {1621#false} is VALID [2018-11-23 10:48:40,353 INFO L134 CoverageAnalysis]: Checked inductivity of 0 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 0 trivial. 0 not checked. [2018-11-23 10:48:40,354 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-23 10:48:40,356 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 10:48:40,356 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-23 10:48:40,360 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 28 [2018-11-23 10:48:40,360 INFO L84 Accepts]: Finished accepts. word is accepted. [2018-11-23 10:48:40,360 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 3 states. [2018-11-23 10:48:40,438 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 28 edges. 28 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:48:40,438 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-23 10:48:40,438 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-23 10:48:40,438 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 10:48:40,439 INFO L87 Difference]: Start difference. First operand 231 states and 326 transitions. Second operand 3 states. [2018-11-23 10:48:41,925 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:48:41,925 INFO L93 Difference]: Finished difference Result 375 states and 514 transitions. [2018-11-23 10:48:41,925 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-23 10:48:41,925 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 28 [2018-11-23 10:48:41,926 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 10:48:41,926 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 3 states. [2018-11-23 10:48:41,935 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 3 states to 3 states and 514 transitions. [2018-11-23 10:48:41,936 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 3 states. [2018-11-23 10:48:41,944 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 3 states to 3 states and 514 transitions. [2018-11-23 10:48:41,945 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 3 states and 514 transitions. [2018-11-23 10:48:42,940 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 514 edges. 514 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:48:42,958 INFO L225 Difference]: With dead ends: 375 [2018-11-23 10:48:42,959 INFO L226 Difference]: Without dead ends: 314 [2018-11-23 10:48:42,961 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 27 GetRequests, 26 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 10:48:42,962 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 314 states. [2018-11-23 10:48:43,109 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 314 to 298. [2018-11-23 10:48:43,110 INFO L214 AbstractMinimizeNwa]: Start testing correctness of minimizeSevpa [2018-11-23 10:48:43,110 INFO L82 GeneralOperation]: Start isEquivalent. First operand 314 states. Second operand 298 states. [2018-11-23 10:48:43,110 INFO L74 IsIncluded]: Start isIncluded. First operand 314 states. Second operand 298 states. [2018-11-23 10:48:43,111 INFO L87 Difference]: Start difference. First operand 314 states. Second operand 298 states. [2018-11-23 10:48:43,127 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:48:43,128 INFO L93 Difference]: Finished difference Result 314 states and 427 transitions. [2018-11-23 10:48:43,128 INFO L276 IsEmpty]: Start isEmpty. Operand 314 states and 427 transitions. [2018-11-23 10:48:43,131 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:48:43,132 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:48:43,132 INFO L74 IsIncluded]: Start isIncluded. First operand 298 states. Second operand 314 states. [2018-11-23 10:48:43,132 INFO L87 Difference]: Start difference. First operand 298 states. Second operand 314 states. [2018-11-23 10:48:43,148 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:48:43,149 INFO L93 Difference]: Finished difference Result 314 states and 427 transitions. [2018-11-23 10:48:43,149 INFO L276 IsEmpty]: Start isEmpty. Operand 314 states and 427 transitions. [2018-11-23 10:48:43,150 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:48:43,151 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:48:43,151 INFO L88 GeneralOperation]: Finished isEquivalent. [2018-11-23 10:48:43,151 INFO L221 AbstractMinimizeNwa]: Finished testing correctness of minimizeSevpa [2018-11-23 10:48:43,151 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 298 states. [2018-11-23 10:48:43,166 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 298 states to 298 states and 408 transitions. [2018-11-23 10:48:43,166 INFO L78 Accepts]: Start accepts. Automaton has 298 states and 408 transitions. Word has length 28 [2018-11-23 10:48:43,167 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 10:48:43,167 INFO L480 AbstractCegarLoop]: Abstraction has 298 states and 408 transitions. [2018-11-23 10:48:43,167 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-23 10:48:43,167 INFO L276 IsEmpty]: Start isEmpty. Operand 298 states and 408 transitions. [2018-11-23 10:48:43,168 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 29 [2018-11-23 10:48:43,168 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 10:48:43,168 INFO L402 BasicCegarLoop]: trace histogram [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 10:48:43,168 INFO L423 AbstractCegarLoop]: === Iteration 3 === [errorFnErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 10:48:43,169 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 10:48:43,169 INFO L82 PathProgramCache]: Analyzing trace with hash 439620198, now seen corresponding path program 1 times [2018-11-23 10:48:43,169 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 10:48:43,169 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/cvc4nyu Starting monitored process 4 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 4 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 10:48:43,196 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 10:48:43,273 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:48:43,303 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:48:43,305 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 10:48:43,407 INFO L256 TraceCheckUtils]: 0: Hoare triple {3235#true} call ULTIMATE.init(); {3235#true} is VALID [2018-11-23 10:48:43,407 INFO L273 TraceCheckUtils]: 1: Hoare triple {3235#true} ~KernelMode~0 := 0bv32;~Executive~0 := 0bv32;~DevicePowerState~0 := 0bv32;~s~0 := 0bv32;~UNLOADED~0 := 0bv32;~NP~0 := 0bv32;~DC~0 := 0bv32;~SKIP1~0 := 0bv32;~SKIP2~0 := 0bv32;~MPR1~0 := 0bv32;~MPR3~0 := 0bv32;~IPC~0 := 0bv32;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32;~myStatus~0 := 0bv32; {3235#true} is VALID [2018-11-23 10:48:43,407 INFO L273 TraceCheckUtils]: 2: Hoare triple {3235#true} assume true; {3235#true} is VALID [2018-11-23 10:48:43,408 INFO L268 TraceCheckUtils]: 3: Hoare quadruple {3235#true} {3235#true} #759#return; {3235#true} is VALID [2018-11-23 10:48:43,408 INFO L256 TraceCheckUtils]: 4: Hoare triple {3235#true} call #t~ret77 := main(); {3235#true} is VALID [2018-11-23 10:48:43,408 INFO L273 TraceCheckUtils]: 5: Hoare triple {3235#true} havoc ~status~1;~irp~0 := #t~nondet17;havoc #t~nondet17;havoc ~pirp~0;havoc ~pirp__IoStatus__Status~0;~irp_choice~0 := #t~nondet18;havoc #t~nondet18;~devobj~0 := #t~nondet19;havoc #t~nondet19;havoc ~__cil_tmp8~0;~KernelMode~0 := 0bv32;~Executive~0 := 0bv32;~DevicePowerState~0 := 1bv32;~s~0 := 0bv32;~UNLOADED~0 := 0bv32;~NP~0 := 0bv32;~DC~0 := 0bv32;~SKIP1~0 := 0bv32;~SKIP2~0 := 0bv32;~MPR1~0 := 0bv32;~MPR3~0 := 0bv32;~IPC~0 := 0bv32;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32;~myStatus~0 := 0bv32;~status~1 := 0bv32;~pirp~0 := ~irp~0; {3235#true} is VALID [2018-11-23 10:48:43,409 INFO L256 TraceCheckUtils]: 6: Hoare triple {3235#true} call _BLAST_init(); {3235#true} is VALID [2018-11-23 10:48:43,409 INFO L273 TraceCheckUtils]: 7: Hoare triple {3235#true} ~UNLOADED~0 := 0bv32;~NP~0 := 1bv32;~DC~0 := 2bv32;~SKIP1~0 := 3bv32;~SKIP2~0 := 4bv32;~MPR1~0 := 5bv32;~MPR3~0 := 6bv32;~IPC~0 := 7bv32;~s~0 := ~UNLOADED~0;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32; {3235#true} is VALID [2018-11-23 10:48:43,409 INFO L273 TraceCheckUtils]: 8: Hoare triple {3235#true} assume true; {3235#true} is VALID [2018-11-23 10:48:43,409 INFO L268 TraceCheckUtils]: 9: Hoare quadruple {3235#true} {3235#true} #717#return; {3235#true} is VALID [2018-11-23 10:48:43,410 INFO L273 TraceCheckUtils]: 10: Hoare triple {3235#true} assume ~bvsge32(~status~1, 0bv32);~s~0 := ~NP~0;~customIrp~0 := 0bv32;~setEventCalled~0 := ~customIrp~0;~lowerDriverReturn~0 := ~setEventCalled~0;~compRegistered~0 := ~lowerDriverReturn~0;~pended~0 := ~compRegistered~0;~pirp__IoStatus__Status~0 := 0bv32;~myStatus~0 := 0bv32; {3235#true} is VALID [2018-11-23 10:48:43,410 INFO L273 TraceCheckUtils]: 11: Hoare triple {3235#true} assume !(0bv32 == ~irp_choice~0); {3235#true} is VALID [2018-11-23 10:48:43,410 INFO L256 TraceCheckUtils]: 12: Hoare triple {3235#true} call stub_driver_init(); {3235#true} is VALID [2018-11-23 10:48:43,427 INFO L273 TraceCheckUtils]: 13: Hoare triple {3235#true} ~s~0 := ~NP~0;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32; {3279#(= (_ bv0 32) ~compRegistered~0)} is VALID [2018-11-23 10:48:43,431 INFO L273 TraceCheckUtils]: 14: Hoare triple {3279#(= (_ bv0 32) ~compRegistered~0)} assume true; {3279#(= (_ bv0 32) ~compRegistered~0)} is VALID [2018-11-23 10:48:43,434 INFO L268 TraceCheckUtils]: 15: Hoare quadruple {3279#(= (_ bv0 32) ~compRegistered~0)} {3235#true} #719#return; {3279#(= (_ bv0 32) ~compRegistered~0)} is VALID [2018-11-23 10:48:43,434 INFO L273 TraceCheckUtils]: 16: Hoare triple {3279#(= (_ bv0 32) ~compRegistered~0)} assume !~bvslt32(~status~1, 0bv32);havoc ~tmp_ndt_1~0;~tmp_ndt_1~0 := #t~nondet20;havoc #t~nondet20; {3279#(= (_ bv0 32) ~compRegistered~0)} is VALID [2018-11-23 10:48:43,436 INFO L273 TraceCheckUtils]: 17: Hoare triple {3279#(= (_ bv0 32) ~compRegistered~0)} assume !(0bv32 == ~tmp_ndt_1~0);havoc ~tmp_ndt_2~0;~tmp_ndt_2~0 := #t~nondet21;havoc #t~nondet21; {3279#(= (_ bv0 32) ~compRegistered~0)} is VALID [2018-11-23 10:48:43,436 INFO L273 TraceCheckUtils]: 18: Hoare triple {3279#(= (_ bv0 32) ~compRegistered~0)} assume !(1bv32 == ~tmp_ndt_2~0);havoc ~tmp_ndt_3~0;~tmp_ndt_3~0 := #t~nondet22;havoc #t~nondet22; {3279#(= (_ bv0 32) ~compRegistered~0)} is VALID [2018-11-23 10:48:43,439 INFO L273 TraceCheckUtils]: 19: Hoare triple {3279#(= (_ bv0 32) ~compRegistered~0)} assume 3bv32 == ~tmp_ndt_3~0; {3279#(= (_ bv0 32) ~compRegistered~0)} is VALID [2018-11-23 10:48:43,441 INFO L256 TraceCheckUtils]: 20: Hoare triple {3279#(= (_ bv0 32) ~compRegistered~0)} call #t~ret27 := KbFilter_PnP(~devobj~0, ~pirp~0); {3279#(= (_ bv0 32) ~compRegistered~0)} is VALID [2018-11-23 10:48:43,443 INFO L273 TraceCheckUtils]: 21: Hoare triple {3279#(= (_ bv0 32) ~compRegistered~0)} ~DeviceObject := #in~DeviceObject;~Irp := #in~Irp;havoc ~devExt~0;havoc ~irpStack~0;havoc ~status~0;~event~0 := #t~nondet0;havoc #t~nondet0;~DeviceObject__DeviceExtension~0 := #t~nondet1;havoc #t~nondet1;~Irp__Tail__Overlay__CurrentStackLocation~0 := #t~nondet2;havoc #t~nondet2;~irpStack__MinorFunction~0 := #t~nondet3;havoc #t~nondet3;~devExt__TopOfStack~0 := #t~nondet4;havoc #t~nondet4;havoc ~devExt__Started~0;havoc ~devExt__Removed~0;havoc ~devExt__SurpriseRemoved~0;havoc ~Irp__IoStatus__Status~0;havoc ~Irp__IoStatus__Information~0;~Irp__CurrentLocation~0 := #t~nondet5;havoc #t~nondet5;havoc ~irpSp~0;havoc ~nextIrpSp~0;havoc ~nextIrpSp__Control~0;havoc ~irpSp___0~0;havoc ~irpSp__Context~0;havoc ~irpSp__Control~0;havoc ~__cil_tmp23~0;~status~0 := 0bv32;~devExt~0 := ~DeviceObject__DeviceExtension~0;~irpStack~0 := ~Irp__Tail__Overlay__CurrentStackLocation~0; {3279#(= (_ bv0 32) ~compRegistered~0)} is VALID [2018-11-23 10:48:43,443 INFO L273 TraceCheckUtils]: 22: Hoare triple {3279#(= (_ bv0 32) ~compRegistered~0)} assume 0bv32 == ~irpStack__MinorFunction~0; {3279#(= (_ bv0 32) ~compRegistered~0)} is VALID [2018-11-23 10:48:43,444 INFO L273 TraceCheckUtils]: 23: Hoare triple {3279#(= (_ bv0 32) ~compRegistered~0)} ~irpSp~0 := ~Irp__Tail__Overlay__CurrentStackLocation~0;~nextIrpSp~0 := ~bvsub32(~Irp__Tail__Overlay__CurrentStackLocation~0, 1bv32);~nextIrpSp__Control~0 := 0bv32; {3279#(= (_ bv0 32) ~compRegistered~0)} is VALID [2018-11-23 10:48:43,445 INFO L273 TraceCheckUtils]: 24: Hoare triple {3279#(= (_ bv0 32) ~compRegistered~0)} assume !(~s~0 != ~NP~0); {3279#(= (_ bv0 32) ~compRegistered~0)} is VALID [2018-11-23 10:48:43,446 INFO L273 TraceCheckUtils]: 25: Hoare triple {3279#(= (_ bv0 32) ~compRegistered~0)} assume 0bv32 != ~compRegistered~0; {3236#false} is VALID [2018-11-23 10:48:43,446 INFO L256 TraceCheckUtils]: 26: Hoare triple {3236#false} call errorFn(); {3236#false} is VALID [2018-11-23 10:48:43,446 INFO L273 TraceCheckUtils]: 27: Hoare triple {3236#false} assume !false; {3236#false} is VALID [2018-11-23 10:48:43,448 INFO L134 CoverageAnalysis]: Checked inductivity of 0 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 0 trivial. 0 not checked. [2018-11-23 10:48:43,448 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-23 10:48:43,452 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 10:48:43,452 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-23 10:48:43,453 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 28 [2018-11-23 10:48:43,453 INFO L84 Accepts]: Finished accepts. word is accepted. [2018-11-23 10:48:43,453 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 3 states. [2018-11-23 10:48:43,500 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 28 edges. 28 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:48:43,500 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-23 10:48:43,500 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-23 10:48:43,500 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 10:48:43,501 INFO L87 Difference]: Start difference. First operand 298 states and 408 transitions. Second operand 3 states. [2018-11-23 10:48:44,537 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:48:44,537 INFO L93 Difference]: Finished difference Result 481 states and 640 transitions. [2018-11-23 10:48:44,538 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-23 10:48:44,538 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 28 [2018-11-23 10:48:44,538 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 10:48:44,538 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 3 states. [2018-11-23 10:48:44,546 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 3 states to 3 states and 501 transitions. [2018-11-23 10:48:44,546 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 3 states. [2018-11-23 10:48:44,553 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 3 states to 3 states and 501 transitions. [2018-11-23 10:48:44,554 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 3 states and 501 transitions. [2018-11-23 10:48:45,357 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 501 edges. 501 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:48:45,370 INFO L225 Difference]: With dead ends: 481 [2018-11-23 10:48:45,371 INFO L226 Difference]: Without dead ends: 362 [2018-11-23 10:48:45,372 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 27 GetRequests, 26 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 10:48:45,373 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 362 states. [2018-11-23 10:48:45,592 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 362 to 338. [2018-11-23 10:48:45,592 INFO L214 AbstractMinimizeNwa]: Start testing correctness of minimizeSevpa [2018-11-23 10:48:45,592 INFO L82 GeneralOperation]: Start isEquivalent. First operand 362 states. Second operand 338 states. [2018-11-23 10:48:45,593 INFO L74 IsIncluded]: Start isIncluded. First operand 362 states. Second operand 338 states. [2018-11-23 10:48:45,593 INFO L87 Difference]: Start difference. First operand 362 states. Second operand 338 states. [2018-11-23 10:48:45,610 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:48:45,611 INFO L93 Difference]: Finished difference Result 362 states and 487 transitions. [2018-11-23 10:48:45,611 INFO L276 IsEmpty]: Start isEmpty. Operand 362 states and 487 transitions. [2018-11-23 10:48:45,612 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:48:45,613 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:48:45,613 INFO L74 IsIncluded]: Start isIncluded. First operand 338 states. Second operand 362 states. [2018-11-23 10:48:45,613 INFO L87 Difference]: Start difference. First operand 338 states. Second operand 362 states. [2018-11-23 10:48:45,631 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:48:45,631 INFO L93 Difference]: Finished difference Result 362 states and 487 transitions. [2018-11-23 10:48:45,631 INFO L276 IsEmpty]: Start isEmpty. Operand 362 states and 487 transitions. [2018-11-23 10:48:45,633 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:48:45,633 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:48:45,633 INFO L88 GeneralOperation]: Finished isEquivalent. [2018-11-23 10:48:45,633 INFO L221 AbstractMinimizeNwa]: Finished testing correctness of minimizeSevpa [2018-11-23 10:48:45,633 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 338 states. [2018-11-23 10:48:45,649 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 338 states to 338 states and 459 transitions. [2018-11-23 10:48:45,650 INFO L78 Accepts]: Start accepts. Automaton has 338 states and 459 transitions. Word has length 28 [2018-11-23 10:48:45,650 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 10:48:45,650 INFO L480 AbstractCegarLoop]: Abstraction has 338 states and 459 transitions. [2018-11-23 10:48:45,651 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-23 10:48:45,651 INFO L276 IsEmpty]: Start isEmpty. Operand 338 states and 459 transitions. [2018-11-23 10:48:45,652 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 39 [2018-11-23 10:48:45,652 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 10:48:45,652 INFO L402 BasicCegarLoop]: trace histogram [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 10:48:45,653 INFO L423 AbstractCegarLoop]: === Iteration 4 === [errorFnErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 10:48:45,653 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 10:48:45,653 INFO L82 PathProgramCache]: Analyzing trace with hash -1607848921, now seen corresponding path program 1 times [2018-11-23 10:48:45,653 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 10:48:45,654 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/cvc4nyu Starting monitored process 5 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 5 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 10:48:45,682 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 10:48:45,764 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:48:45,808 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:48:45,810 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 10:48:45,902 INFO L256 TraceCheckUtils]: 0: Hoare triple {5119#true} call ULTIMATE.init(); {5119#true} is VALID [2018-11-23 10:48:45,903 INFO L273 TraceCheckUtils]: 1: Hoare triple {5119#true} ~KernelMode~0 := 0bv32;~Executive~0 := 0bv32;~DevicePowerState~0 := 0bv32;~s~0 := 0bv32;~UNLOADED~0 := 0bv32;~NP~0 := 0bv32;~DC~0 := 0bv32;~SKIP1~0 := 0bv32;~SKIP2~0 := 0bv32;~MPR1~0 := 0bv32;~MPR3~0 := 0bv32;~IPC~0 := 0bv32;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32;~myStatus~0 := 0bv32; {5119#true} is VALID [2018-11-23 10:48:45,903 INFO L273 TraceCheckUtils]: 2: Hoare triple {5119#true} assume true; {5119#true} is VALID [2018-11-23 10:48:45,903 INFO L268 TraceCheckUtils]: 3: Hoare quadruple {5119#true} {5119#true} #759#return; {5119#true} is VALID [2018-11-23 10:48:45,904 INFO L256 TraceCheckUtils]: 4: Hoare triple {5119#true} call #t~ret77 := main(); {5119#true} is VALID [2018-11-23 10:48:45,904 INFO L273 TraceCheckUtils]: 5: Hoare triple {5119#true} havoc ~status~1;~irp~0 := #t~nondet17;havoc #t~nondet17;havoc ~pirp~0;havoc ~pirp__IoStatus__Status~0;~irp_choice~0 := #t~nondet18;havoc #t~nondet18;~devobj~0 := #t~nondet19;havoc #t~nondet19;havoc ~__cil_tmp8~0;~KernelMode~0 := 0bv32;~Executive~0 := 0bv32;~DevicePowerState~0 := 1bv32;~s~0 := 0bv32;~UNLOADED~0 := 0bv32;~NP~0 := 0bv32;~DC~0 := 0bv32;~SKIP1~0 := 0bv32;~SKIP2~0 := 0bv32;~MPR1~0 := 0bv32;~MPR3~0 := 0bv32;~IPC~0 := 0bv32;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32;~myStatus~0 := 0bv32;~status~1 := 0bv32;~pirp~0 := ~irp~0; {5119#true} is VALID [2018-11-23 10:48:45,904 INFO L256 TraceCheckUtils]: 6: Hoare triple {5119#true} call _BLAST_init(); {5119#true} is VALID [2018-11-23 10:48:45,905 INFO L273 TraceCheckUtils]: 7: Hoare triple {5119#true} ~UNLOADED~0 := 0bv32;~NP~0 := 1bv32;~DC~0 := 2bv32;~SKIP1~0 := 3bv32;~SKIP2~0 := 4bv32;~MPR1~0 := 5bv32;~MPR3~0 := 6bv32;~IPC~0 := 7bv32;~s~0 := ~UNLOADED~0;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32; {5119#true} is VALID [2018-11-23 10:48:45,905 INFO L273 TraceCheckUtils]: 8: Hoare triple {5119#true} assume true; {5119#true} is VALID [2018-11-23 10:48:45,905 INFO L268 TraceCheckUtils]: 9: Hoare quadruple {5119#true} {5119#true} #717#return; {5119#true} is VALID [2018-11-23 10:48:45,905 INFO L273 TraceCheckUtils]: 10: Hoare triple {5119#true} assume ~bvsge32(~status~1, 0bv32);~s~0 := ~NP~0;~customIrp~0 := 0bv32;~setEventCalled~0 := ~customIrp~0;~lowerDriverReturn~0 := ~setEventCalled~0;~compRegistered~0 := ~lowerDriverReturn~0;~pended~0 := ~compRegistered~0;~pirp__IoStatus__Status~0 := 0bv32;~myStatus~0 := 0bv32; {5119#true} is VALID [2018-11-23 10:48:45,905 INFO L273 TraceCheckUtils]: 11: Hoare triple {5119#true} assume !(0bv32 == ~irp_choice~0); {5119#true} is VALID [2018-11-23 10:48:45,906 INFO L256 TraceCheckUtils]: 12: Hoare triple {5119#true} call stub_driver_init(); {5119#true} is VALID [2018-11-23 10:48:45,906 INFO L273 TraceCheckUtils]: 13: Hoare triple {5119#true} ~s~0 := ~NP~0;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32; {5119#true} is VALID [2018-11-23 10:48:45,906 INFO L273 TraceCheckUtils]: 14: Hoare triple {5119#true} assume true; {5119#true} is VALID [2018-11-23 10:48:45,906 INFO L268 TraceCheckUtils]: 15: Hoare quadruple {5119#true} {5119#true} #719#return; {5119#true} is VALID [2018-11-23 10:48:45,907 INFO L273 TraceCheckUtils]: 16: Hoare triple {5119#true} assume !~bvslt32(~status~1, 0bv32);havoc ~tmp_ndt_1~0;~tmp_ndt_1~0 := #t~nondet20;havoc #t~nondet20; {5119#true} is VALID [2018-11-23 10:48:45,907 INFO L273 TraceCheckUtils]: 17: Hoare triple {5119#true} assume 0bv32 == ~tmp_ndt_1~0; {5119#true} is VALID [2018-11-23 10:48:45,907 INFO L256 TraceCheckUtils]: 18: Hoare triple {5119#true} call #t~ret25 := KbFilter_CreateClose(~devobj~0, ~pirp~0); {5119#true} is VALID [2018-11-23 10:48:45,907 INFO L273 TraceCheckUtils]: 19: Hoare triple {5119#true} ~DeviceObject := #in~DeviceObject;~Irp := #in~Irp;~irpStack__MajorFunction~0 := #t~nondet37;havoc #t~nondet37;~devExt__UpperConnectData__ClassService~0 := #t~nondet38;havoc #t~nondet38;havoc ~Irp__IoStatus__Status~1;havoc ~status~2;havoc ~tmp~0;~status~2 := ~myStatus~0; {5119#true} is VALID [2018-11-23 10:48:45,908 INFO L273 TraceCheckUtils]: 20: Hoare triple {5119#true} assume 0bv32 == ~irpStack__MajorFunction~0; {5119#true} is VALID [2018-11-23 10:48:45,908 INFO L273 TraceCheckUtils]: 21: Hoare triple {5119#true} assume 0bv32 == ~devExt__UpperConnectData__ClassService~0;~status~2 := 3221225860bv32; {5119#true} is VALID [2018-11-23 10:48:45,908 INFO L273 TraceCheckUtils]: 22: Hoare triple {5119#true} ~Irp__IoStatus__Status~1 := ~status~2;~myStatus~0 := ~status~2; {5119#true} is VALID [2018-11-23 10:48:45,908 INFO L256 TraceCheckUtils]: 23: Hoare triple {5119#true} call #t~ret39 := KbFilter_DispatchPassThrough(~DeviceObject, ~Irp); {5119#true} is VALID [2018-11-23 10:48:45,909 INFO L273 TraceCheckUtils]: 24: Hoare triple {5119#true} ~DeviceObject := #in~DeviceObject;~Irp := #in~Irp;~Irp__Tail__Overlay__CurrentStackLocation~1 := #t~nondet40;havoc #t~nondet40;~Irp__CurrentLocation~1 := #t~nondet41;havoc #t~nondet41;~DeviceObject__DeviceExtension__TopOfStack~0 := #t~nondet42;havoc #t~nondet42;havoc ~irpStack~1;havoc ~tmp~1;~irpStack~1 := ~Irp__Tail__Overlay__CurrentStackLocation~1; {5119#true} is VALID [2018-11-23 10:48:45,909 INFO L273 TraceCheckUtils]: 25: Hoare triple {5119#true} assume ~s~0 == ~NP~0;~s~0 := ~SKIP1~0; {5199#(= ~SKIP1~0 ~s~0)} is VALID [2018-11-23 10:48:45,911 INFO L273 TraceCheckUtils]: 26: Hoare triple {5199#(= ~SKIP1~0 ~s~0)} #t~post43 := ~Irp__CurrentLocation~1;~Irp__CurrentLocation~1 := ~bvadd32(1bv32, #t~post43);havoc #t~post43;#t~post44 := ~Irp__Tail__Overlay__CurrentStackLocation~1;~Irp__Tail__Overlay__CurrentStackLocation~1 := ~bvadd32(1bv32, #t~post44);havoc #t~post44; {5199#(= ~SKIP1~0 ~s~0)} is VALID [2018-11-23 10:48:45,912 INFO L256 TraceCheckUtils]: 27: Hoare triple {5199#(= ~SKIP1~0 ~s~0)} call #t~ret45 := IofCallDriver(~DeviceObject__DeviceExtension__TopOfStack~0, ~Irp); {5199#(= ~SKIP1~0 ~s~0)} is VALID [2018-11-23 10:48:45,917 INFO L273 TraceCheckUtils]: 28: Hoare triple {5199#(= ~SKIP1~0 ~s~0)} ~DeviceObject := #in~DeviceObject;~Irp := #in~Irp;havoc ~returnVal2~0;havoc ~compRetStatus~0;~lcontext~0 := #t~nondet30;havoc #t~nondet30;havoc ~__cil_tmp7~0; {5199#(= ~SKIP1~0 ~s~0)} is VALID [2018-11-23 10:48:45,918 INFO L273 TraceCheckUtils]: 29: Hoare triple {5199#(= ~SKIP1~0 ~s~0)} assume !(0bv32 != ~compRegistered~0); {5199#(= ~SKIP1~0 ~s~0)} is VALID [2018-11-23 10:48:45,918 INFO L273 TraceCheckUtils]: 30: Hoare triple {5199#(= ~SKIP1~0 ~s~0)} havoc ~tmp_ndt_6~0;~tmp_ndt_6~0 := #t~nondet32;havoc #t~nondet32; {5199#(= ~SKIP1~0 ~s~0)} is VALID [2018-11-23 10:48:45,919 INFO L273 TraceCheckUtils]: 31: Hoare triple {5199#(= ~SKIP1~0 ~s~0)} assume 0bv32 == ~tmp_ndt_6~0; {5199#(= ~SKIP1~0 ~s~0)} is VALID [2018-11-23 10:48:45,919 INFO L273 TraceCheckUtils]: 32: Hoare triple {5199#(= ~SKIP1~0 ~s~0)} ~returnVal2~0 := 0bv32; {5199#(= ~SKIP1~0 ~s~0)} is VALID [2018-11-23 10:48:45,920 INFO L273 TraceCheckUtils]: 33: Hoare triple {5199#(= ~SKIP1~0 ~s~0)} assume !(~s~0 == ~NP~0); {5199#(= ~SKIP1~0 ~s~0)} is VALID [2018-11-23 10:48:45,920 INFO L273 TraceCheckUtils]: 34: Hoare triple {5199#(= ~SKIP1~0 ~s~0)} assume !(~s~0 == ~MPR1~0); {5199#(= ~SKIP1~0 ~s~0)} is VALID [2018-11-23 10:48:45,922 INFO L273 TraceCheckUtils]: 35: Hoare triple {5199#(= ~SKIP1~0 ~s~0)} assume !(~s~0 == ~SKIP1~0); {5120#false} is VALID [2018-11-23 10:48:45,922 INFO L256 TraceCheckUtils]: 36: Hoare triple {5120#false} call errorFn(); {5120#false} is VALID [2018-11-23 10:48:45,923 INFO L273 TraceCheckUtils]: 37: Hoare triple {5120#false} assume !false; {5120#false} is VALID [2018-11-23 10:48:45,926 INFO L134 CoverageAnalysis]: Checked inductivity of 0 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 0 trivial. 0 not checked. [2018-11-23 10:48:45,926 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-23 10:48:45,928 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 10:48:45,929 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-23 10:48:45,929 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 38 [2018-11-23 10:48:45,929 INFO L84 Accepts]: Finished accepts. word is accepted. [2018-11-23 10:48:45,929 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 3 states. [2018-11-23 10:48:46,017 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 38 edges. 38 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:48:46,017 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-23 10:48:46,018 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-23 10:48:46,018 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 10:48:46,018 INFO L87 Difference]: Start difference. First operand 338 states and 459 transitions. Second operand 3 states. [2018-11-23 10:48:47,188 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:48:47,188 INFO L93 Difference]: Finished difference Result 341 states and 461 transitions. [2018-11-23 10:48:47,188 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-23 10:48:47,188 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 38 [2018-11-23 10:48:47,189 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 10:48:47,189 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 3 states. [2018-11-23 10:48:47,203 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 3 states to 3 states and 322 transitions. [2018-11-23 10:48:47,206 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 3 states. [2018-11-23 10:48:47,213 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 3 states to 3 states and 322 transitions. [2018-11-23 10:48:47,213 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 3 states and 322 transitions. [2018-11-23 10:48:47,591 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 322 edges. 322 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:48:47,603 INFO L225 Difference]: With dead ends: 341 [2018-11-23 10:48:47,603 INFO L226 Difference]: Without dead ends: 337 [2018-11-23 10:48:47,603 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 37 GetRequests, 36 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 10:48:47,604 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 337 states. [2018-11-23 10:48:47,820 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 337 to 337. [2018-11-23 10:48:47,820 INFO L214 AbstractMinimizeNwa]: Start testing correctness of minimizeSevpa [2018-11-23 10:48:47,820 INFO L82 GeneralOperation]: Start isEquivalent. First operand 337 states. Second operand 337 states. [2018-11-23 10:48:47,821 INFO L74 IsIncluded]: Start isIncluded. First operand 337 states. Second operand 337 states. [2018-11-23 10:48:47,821 INFO L87 Difference]: Start difference. First operand 337 states. Second operand 337 states. [2018-11-23 10:48:47,834 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:48:47,835 INFO L93 Difference]: Finished difference Result 337 states and 456 transitions. [2018-11-23 10:48:47,835 INFO L276 IsEmpty]: Start isEmpty. Operand 337 states and 456 transitions. [2018-11-23 10:48:47,836 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:48:47,837 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:48:47,837 INFO L74 IsIncluded]: Start isIncluded. First operand 337 states. Second operand 337 states. [2018-11-23 10:48:47,837 INFO L87 Difference]: Start difference. First operand 337 states. Second operand 337 states. [2018-11-23 10:48:47,850 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:48:47,850 INFO L93 Difference]: Finished difference Result 337 states and 456 transitions. [2018-11-23 10:48:47,851 INFO L276 IsEmpty]: Start isEmpty. Operand 337 states and 456 transitions. [2018-11-23 10:48:47,852 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:48:47,852 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:48:47,853 INFO L88 GeneralOperation]: Finished isEquivalent. [2018-11-23 10:48:47,853 INFO L221 AbstractMinimizeNwa]: Finished testing correctness of minimizeSevpa [2018-11-23 10:48:47,853 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 337 states. [2018-11-23 10:48:47,866 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 337 states to 337 states and 456 transitions. [2018-11-23 10:48:47,866 INFO L78 Accepts]: Start accepts. Automaton has 337 states and 456 transitions. Word has length 38 [2018-11-23 10:48:47,867 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 10:48:47,867 INFO L480 AbstractCegarLoop]: Abstraction has 337 states and 456 transitions. [2018-11-23 10:48:47,867 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-23 10:48:47,867 INFO L276 IsEmpty]: Start isEmpty. Operand 337 states and 456 transitions. [2018-11-23 10:48:47,869 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 47 [2018-11-23 10:48:47,869 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 10:48:47,869 INFO L402 BasicCegarLoop]: trace histogram [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 10:48:47,869 INFO L423 AbstractCegarLoop]: === Iteration 5 === [errorFnErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 10:48:47,870 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 10:48:47,870 INFO L82 PathProgramCache]: Analyzing trace with hash 1742109340, now seen corresponding path program 1 times [2018-11-23 10:48:47,870 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 10:48:47,870 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/cvc4nyu Starting monitored process 6 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 6 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 10:48:47,893 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 10:48:47,992 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:48:48,039 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:48:48,041 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 10:48:48,555 INFO L256 TraceCheckUtils]: 0: Hoare triple {6802#true} call ULTIMATE.init(); {6802#true} is VALID [2018-11-23 10:48:48,556 INFO L273 TraceCheckUtils]: 1: Hoare triple {6802#true} ~KernelMode~0 := 0bv32;~Executive~0 := 0bv32;~DevicePowerState~0 := 0bv32;~s~0 := 0bv32;~UNLOADED~0 := 0bv32;~NP~0 := 0bv32;~DC~0 := 0bv32;~SKIP1~0 := 0bv32;~SKIP2~0 := 0bv32;~MPR1~0 := 0bv32;~MPR3~0 := 0bv32;~IPC~0 := 0bv32;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32;~myStatus~0 := 0bv32; {6802#true} is VALID [2018-11-23 10:48:48,556 INFO L273 TraceCheckUtils]: 2: Hoare triple {6802#true} assume true; {6802#true} is VALID [2018-11-23 10:48:48,557 INFO L268 TraceCheckUtils]: 3: Hoare quadruple {6802#true} {6802#true} #759#return; {6802#true} is VALID [2018-11-23 10:48:48,557 INFO L256 TraceCheckUtils]: 4: Hoare triple {6802#true} call #t~ret77 := main(); {6802#true} is VALID [2018-11-23 10:48:48,557 INFO L273 TraceCheckUtils]: 5: Hoare triple {6802#true} havoc ~status~1;~irp~0 := #t~nondet17;havoc #t~nondet17;havoc ~pirp~0;havoc ~pirp__IoStatus__Status~0;~irp_choice~0 := #t~nondet18;havoc #t~nondet18;~devobj~0 := #t~nondet19;havoc #t~nondet19;havoc ~__cil_tmp8~0;~KernelMode~0 := 0bv32;~Executive~0 := 0bv32;~DevicePowerState~0 := 1bv32;~s~0 := 0bv32;~UNLOADED~0 := 0bv32;~NP~0 := 0bv32;~DC~0 := 0bv32;~SKIP1~0 := 0bv32;~SKIP2~0 := 0bv32;~MPR1~0 := 0bv32;~MPR3~0 := 0bv32;~IPC~0 := 0bv32;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32;~myStatus~0 := 0bv32;~status~1 := 0bv32;~pirp~0 := ~irp~0; {6802#true} is VALID [2018-11-23 10:48:48,558 INFO L256 TraceCheckUtils]: 6: Hoare triple {6802#true} call _BLAST_init(); {6802#true} is VALID [2018-11-23 10:48:48,558 INFO L273 TraceCheckUtils]: 7: Hoare triple {6802#true} ~UNLOADED~0 := 0bv32;~NP~0 := 1bv32;~DC~0 := 2bv32;~SKIP1~0 := 3bv32;~SKIP2~0 := 4bv32;~MPR1~0 := 5bv32;~MPR3~0 := 6bv32;~IPC~0 := 7bv32;~s~0 := ~UNLOADED~0;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32; {6802#true} is VALID [2018-11-23 10:48:48,558 INFO L273 TraceCheckUtils]: 8: Hoare triple {6802#true} assume true; {6802#true} is VALID [2018-11-23 10:48:48,558 INFO L268 TraceCheckUtils]: 9: Hoare quadruple {6802#true} {6802#true} #717#return; {6802#true} is VALID [2018-11-23 10:48:48,559 INFO L273 TraceCheckUtils]: 10: Hoare triple {6802#true} assume ~bvsge32(~status~1, 0bv32);~s~0 := ~NP~0;~customIrp~0 := 0bv32;~setEventCalled~0 := ~customIrp~0;~lowerDriverReturn~0 := ~setEventCalled~0;~compRegistered~0 := ~lowerDriverReturn~0;~pended~0 := ~compRegistered~0;~pirp__IoStatus__Status~0 := 0bv32;~myStatus~0 := 0bv32; {6802#true} is VALID [2018-11-23 10:48:48,559 INFO L273 TraceCheckUtils]: 11: Hoare triple {6802#true} assume !(0bv32 == ~irp_choice~0); {6802#true} is VALID [2018-11-23 10:48:48,559 INFO L256 TraceCheckUtils]: 12: Hoare triple {6802#true} call stub_driver_init(); {6802#true} is VALID [2018-11-23 10:48:48,560 INFO L273 TraceCheckUtils]: 13: Hoare triple {6802#true} ~s~0 := ~NP~0;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32; {6802#true} is VALID [2018-11-23 10:48:48,560 INFO L273 TraceCheckUtils]: 14: Hoare triple {6802#true} assume true; {6802#true} is VALID [2018-11-23 10:48:48,560 INFO L268 TraceCheckUtils]: 15: Hoare quadruple {6802#true} {6802#true} #719#return; {6802#true} is VALID [2018-11-23 10:48:48,561 INFO L273 TraceCheckUtils]: 16: Hoare triple {6802#true} assume !~bvslt32(~status~1, 0bv32);havoc ~tmp_ndt_1~0;~tmp_ndt_1~0 := #t~nondet20;havoc #t~nondet20; {6802#true} is VALID [2018-11-23 10:48:48,561 INFO L273 TraceCheckUtils]: 17: Hoare triple {6802#true} assume !(0bv32 == ~tmp_ndt_1~0);havoc ~tmp_ndt_2~0;~tmp_ndt_2~0 := #t~nondet21;havoc #t~nondet21; {6802#true} is VALID [2018-11-23 10:48:48,561 INFO L273 TraceCheckUtils]: 18: Hoare triple {6802#true} assume !(1bv32 == ~tmp_ndt_2~0);havoc ~tmp_ndt_3~0;~tmp_ndt_3~0 := #t~nondet22;havoc #t~nondet22; {6802#true} is VALID [2018-11-23 10:48:48,562 INFO L273 TraceCheckUtils]: 19: Hoare triple {6802#true} assume 3bv32 == ~tmp_ndt_3~0; {6802#true} is VALID [2018-11-23 10:48:48,562 INFO L256 TraceCheckUtils]: 20: Hoare triple {6802#true} call #t~ret27 := KbFilter_PnP(~devobj~0, ~pirp~0); {6802#true} is VALID [2018-11-23 10:48:48,562 INFO L273 TraceCheckUtils]: 21: Hoare triple {6802#true} ~DeviceObject := #in~DeviceObject;~Irp := #in~Irp;havoc ~devExt~0;havoc ~irpStack~0;havoc ~status~0;~event~0 := #t~nondet0;havoc #t~nondet0;~DeviceObject__DeviceExtension~0 := #t~nondet1;havoc #t~nondet1;~Irp__Tail__Overlay__CurrentStackLocation~0 := #t~nondet2;havoc #t~nondet2;~irpStack__MinorFunction~0 := #t~nondet3;havoc #t~nondet3;~devExt__TopOfStack~0 := #t~nondet4;havoc #t~nondet4;havoc ~devExt__Started~0;havoc ~devExt__Removed~0;havoc ~devExt__SurpriseRemoved~0;havoc ~Irp__IoStatus__Status~0;havoc ~Irp__IoStatus__Information~0;~Irp__CurrentLocation~0 := #t~nondet5;havoc #t~nondet5;havoc ~irpSp~0;havoc ~nextIrpSp~0;havoc ~nextIrpSp__Control~0;havoc ~irpSp___0~0;havoc ~irpSp__Context~0;havoc ~irpSp__Control~0;havoc ~__cil_tmp23~0;~status~0 := 0bv32;~devExt~0 := ~DeviceObject__DeviceExtension~0;~irpStack~0 := ~Irp__Tail__Overlay__CurrentStackLocation~0; {6802#true} is VALID [2018-11-23 10:48:48,562 INFO L273 TraceCheckUtils]: 22: Hoare triple {6802#true} assume 0bv32 == ~irpStack__MinorFunction~0; {6802#true} is VALID [2018-11-23 10:48:48,563 INFO L273 TraceCheckUtils]: 23: Hoare triple {6802#true} ~irpSp~0 := ~Irp__Tail__Overlay__CurrentStackLocation~0;~nextIrpSp~0 := ~bvsub32(~Irp__Tail__Overlay__CurrentStackLocation~0, 1bv32);~nextIrpSp__Control~0 := 0bv32; {6802#true} is VALID [2018-11-23 10:48:48,563 INFO L273 TraceCheckUtils]: 24: Hoare triple {6802#true} assume !(~s~0 != ~NP~0); {6802#true} is VALID [2018-11-23 10:48:48,563 INFO L273 TraceCheckUtils]: 25: Hoare triple {6802#true} assume !(0bv32 != ~compRegistered~0);~compRegistered~0 := 1bv32; {6802#true} is VALID [2018-11-23 10:48:48,563 INFO L273 TraceCheckUtils]: 26: Hoare triple {6802#true} ~irpSp___0~0 := ~bvsub32(~Irp__Tail__Overlay__CurrentStackLocation~0, 1bv32);~irpSp__Context~0 := ~event~0;~irpSp__Control~0 := 224bv32; {6802#true} is VALID [2018-11-23 10:48:48,564 INFO L256 TraceCheckUtils]: 27: Hoare triple {6802#true} call #t~ret6 := IofCallDriver(~devExt__TopOfStack~0, ~Irp); {6802#true} is VALID [2018-11-23 10:48:48,564 INFO L273 TraceCheckUtils]: 28: Hoare triple {6802#true} ~DeviceObject := #in~DeviceObject;~Irp := #in~Irp;havoc ~returnVal2~0;havoc ~compRetStatus~0;~lcontext~0 := #t~nondet30;havoc #t~nondet30;havoc ~__cil_tmp7~0; {6802#true} is VALID [2018-11-23 10:48:48,564 INFO L273 TraceCheckUtils]: 29: Hoare triple {6802#true} assume !(0bv32 != ~compRegistered~0); {6802#true} is VALID [2018-11-23 10:48:48,565 INFO L273 TraceCheckUtils]: 30: Hoare triple {6802#true} havoc ~tmp_ndt_6~0;~tmp_ndt_6~0 := #t~nondet32;havoc #t~nondet32; {6802#true} is VALID [2018-11-23 10:48:48,565 INFO L273 TraceCheckUtils]: 31: Hoare triple {6802#true} assume 0bv32 == ~tmp_ndt_6~0; {6802#true} is VALID [2018-11-23 10:48:48,565 INFO L273 TraceCheckUtils]: 32: Hoare triple {6802#true} ~returnVal2~0 := 0bv32; {6802#true} is VALID [2018-11-23 10:48:48,565 INFO L273 TraceCheckUtils]: 33: Hoare triple {6802#true} assume ~s~0 == ~NP~0;~s~0 := ~IPC~0;~lowerDriverReturn~0 := ~returnVal2~0; {6802#true} is VALID [2018-11-23 10:48:48,566 INFO L273 TraceCheckUtils]: 34: Hoare triple {6802#true} #res := ~returnVal2~0; {6802#true} is VALID [2018-11-23 10:48:48,566 INFO L273 TraceCheckUtils]: 35: Hoare triple {6802#true} assume true; {6802#true} is VALID [2018-11-23 10:48:48,566 INFO L268 TraceCheckUtils]: 36: Hoare quadruple {6802#true} {6802#true} #771#return; {6802#true} is VALID [2018-11-23 10:48:48,567 INFO L273 TraceCheckUtils]: 37: Hoare triple {6802#true} ~status~0 := #t~ret6;havoc #t~ret6;~__cil_tmp23~0 := ~status~0; {6802#true} is VALID [2018-11-23 10:48:48,567 INFO L273 TraceCheckUtils]: 38: Hoare triple {6802#true} assume 259bv32 == ~__cil_tmp23~0; {6802#true} is VALID [2018-11-23 10:48:48,567 INFO L256 TraceCheckUtils]: 39: Hoare triple {6802#true} call #t~ret7 := KeWaitForSingleObject(~event~0, ~Executive~0, ~KernelMode~0, 0bv32, 0bv32); {6802#true} is VALID [2018-11-23 10:48:48,568 INFO L273 TraceCheckUtils]: 40: Hoare triple {6802#true} ~Object := #in~Object;~WaitReason := #in~WaitReason;~WaitMode := #in~WaitMode;~Alertable := #in~Alertable;~Timeout := #in~Timeout; {6802#true} is VALID [2018-11-23 10:48:48,575 INFO L273 TraceCheckUtils]: 41: Hoare triple {6802#true} assume !(~s~0 == ~MPR3~0); {6930#(not (= ~MPR3~0 ~s~0))} is VALID [2018-11-23 10:48:48,581 INFO L273 TraceCheckUtils]: 42: Hoare triple {6930#(not (= ~MPR3~0 ~s~0))} assume !(1bv32 == ~customIrp~0); {6930#(not (= ~MPR3~0 ~s~0))} is VALID [2018-11-23 10:48:48,583 INFO L273 TraceCheckUtils]: 43: Hoare triple {6930#(not (= ~MPR3~0 ~s~0))} assume ~s~0 == ~MPR3~0; {6803#false} is VALID [2018-11-23 10:48:48,583 INFO L256 TraceCheckUtils]: 44: Hoare triple {6803#false} call errorFn(); {6803#false} is VALID [2018-11-23 10:48:48,583 INFO L273 TraceCheckUtils]: 45: Hoare triple {6803#false} assume !false; {6803#false} is VALID [2018-11-23 10:48:48,587 INFO L134 CoverageAnalysis]: Checked inductivity of 0 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 0 trivial. 0 not checked. [2018-11-23 10:48:48,587 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-23 10:48:48,592 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 10:48:48,592 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-23 10:48:48,592 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 46 [2018-11-23 10:48:48,593 INFO L84 Accepts]: Finished accepts. word is accepted. [2018-11-23 10:48:48,593 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 3 states. [2018-11-23 10:48:48,668 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 46 edges. 46 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:48:48,668 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-23 10:48:48,668 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-23 10:48:48,669 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 10:48:48,669 INFO L87 Difference]: Start difference. First operand 337 states and 456 transitions. Second operand 3 states. [2018-11-23 10:48:50,274 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:48:50,274 INFO L93 Difference]: Finished difference Result 385 states and 523 transitions. [2018-11-23 10:48:50,274 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-23 10:48:50,274 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 46 [2018-11-23 10:48:50,275 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 10:48:50,275 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 3 states. [2018-11-23 10:48:50,279 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 3 states to 3 states and 340 transitions. [2018-11-23 10:48:50,279 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 3 states. [2018-11-23 10:48:50,283 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 3 states to 3 states and 340 transitions. [2018-11-23 10:48:50,283 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 3 states and 340 transitions. [2018-11-23 10:48:51,101 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 340 edges. 340 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:48:51,114 INFO L225 Difference]: With dead ends: 385 [2018-11-23 10:48:51,114 INFO L226 Difference]: Without dead ends: 382 [2018-11-23 10:48:51,115 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 45 GetRequests, 44 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 10:48:51,115 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 382 states. [2018-11-23 10:48:51,367 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 382 to 349. [2018-11-23 10:48:51,367 INFO L214 AbstractMinimizeNwa]: Start testing correctness of minimizeSevpa [2018-11-23 10:48:51,367 INFO L82 GeneralOperation]: Start isEquivalent. First operand 382 states. Second operand 349 states. [2018-11-23 10:48:51,367 INFO L74 IsIncluded]: Start isIncluded. First operand 382 states. Second operand 349 states. [2018-11-23 10:48:51,367 INFO L87 Difference]: Start difference. First operand 382 states. Second operand 349 states. [2018-11-23 10:48:51,383 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:48:51,383 INFO L93 Difference]: Finished difference Result 382 states and 518 transitions. [2018-11-23 10:48:51,383 INFO L276 IsEmpty]: Start isEmpty. Operand 382 states and 518 transitions. [2018-11-23 10:48:51,385 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:48:51,385 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:48:51,385 INFO L74 IsIncluded]: Start isIncluded. First operand 349 states. Second operand 382 states. [2018-11-23 10:48:51,385 INFO L87 Difference]: Start difference. First operand 349 states. Second operand 382 states. [2018-11-23 10:48:51,399 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:48:51,400 INFO L93 Difference]: Finished difference Result 382 states and 518 transitions. [2018-11-23 10:48:51,400 INFO L276 IsEmpty]: Start isEmpty. Operand 382 states and 518 transitions. [2018-11-23 10:48:51,401 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:48:51,402 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:48:51,402 INFO L88 GeneralOperation]: Finished isEquivalent. [2018-11-23 10:48:51,402 INFO L221 AbstractMinimizeNwa]: Finished testing correctness of minimizeSevpa [2018-11-23 10:48:51,402 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 349 states. [2018-11-23 10:48:51,416 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 349 states to 349 states and 472 transitions. [2018-11-23 10:48:51,416 INFO L78 Accepts]: Start accepts. Automaton has 349 states and 472 transitions. Word has length 46 [2018-11-23 10:48:51,417 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 10:48:51,417 INFO L480 AbstractCegarLoop]: Abstraction has 349 states and 472 transitions. [2018-11-23 10:48:51,417 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-23 10:48:51,417 INFO L276 IsEmpty]: Start isEmpty. Operand 349 states and 472 transitions. [2018-11-23 10:48:51,419 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 47 [2018-11-23 10:48:51,419 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 10:48:51,419 INFO L402 BasicCegarLoop]: trace histogram [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 10:48:51,419 INFO L423 AbstractCegarLoop]: === Iteration 6 === [errorFnErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 10:48:51,420 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 10:48:51,420 INFO L82 PathProgramCache]: Analyzing trace with hash -1876426227, now seen corresponding path program 1 times [2018-11-23 10:48:51,420 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 10:48:51,420 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/cvc4nyu Starting monitored process 7 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 7 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 10:48:51,451 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 10:48:51,545 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:48:51,601 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:48:51,605 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 10:48:51,997 INFO L256 TraceCheckUtils]: 0: Hoare triple {8676#true} call ULTIMATE.init(); {8676#true} is VALID [2018-11-23 10:48:51,998 INFO L273 TraceCheckUtils]: 1: Hoare triple {8676#true} ~KernelMode~0 := 0bv32;~Executive~0 := 0bv32;~DevicePowerState~0 := 0bv32;~s~0 := 0bv32;~UNLOADED~0 := 0bv32;~NP~0 := 0bv32;~DC~0 := 0bv32;~SKIP1~0 := 0bv32;~SKIP2~0 := 0bv32;~MPR1~0 := 0bv32;~MPR3~0 := 0bv32;~IPC~0 := 0bv32;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32;~myStatus~0 := 0bv32; {8676#true} is VALID [2018-11-23 10:48:51,998 INFO L273 TraceCheckUtils]: 2: Hoare triple {8676#true} assume true; {8676#true} is VALID [2018-11-23 10:48:51,998 INFO L268 TraceCheckUtils]: 3: Hoare quadruple {8676#true} {8676#true} #759#return; {8676#true} is VALID [2018-11-23 10:48:51,998 INFO L256 TraceCheckUtils]: 4: Hoare triple {8676#true} call #t~ret77 := main(); {8676#true} is VALID [2018-11-23 10:48:51,999 INFO L273 TraceCheckUtils]: 5: Hoare triple {8676#true} havoc ~status~1;~irp~0 := #t~nondet17;havoc #t~nondet17;havoc ~pirp~0;havoc ~pirp__IoStatus__Status~0;~irp_choice~0 := #t~nondet18;havoc #t~nondet18;~devobj~0 := #t~nondet19;havoc #t~nondet19;havoc ~__cil_tmp8~0;~KernelMode~0 := 0bv32;~Executive~0 := 0bv32;~DevicePowerState~0 := 1bv32;~s~0 := 0bv32;~UNLOADED~0 := 0bv32;~NP~0 := 0bv32;~DC~0 := 0bv32;~SKIP1~0 := 0bv32;~SKIP2~0 := 0bv32;~MPR1~0 := 0bv32;~MPR3~0 := 0bv32;~IPC~0 := 0bv32;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32;~myStatus~0 := 0bv32;~status~1 := 0bv32;~pirp~0 := ~irp~0; {8676#true} is VALID [2018-11-23 10:48:51,999 INFO L256 TraceCheckUtils]: 6: Hoare triple {8676#true} call _BLAST_init(); {8676#true} is VALID [2018-11-23 10:48:51,999 INFO L273 TraceCheckUtils]: 7: Hoare triple {8676#true} ~UNLOADED~0 := 0bv32;~NP~0 := 1bv32;~DC~0 := 2bv32;~SKIP1~0 := 3bv32;~SKIP2~0 := 4bv32;~MPR1~0 := 5bv32;~MPR3~0 := 6bv32;~IPC~0 := 7bv32;~s~0 := ~UNLOADED~0;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32; {8676#true} is VALID [2018-11-23 10:48:51,999 INFO L273 TraceCheckUtils]: 8: Hoare triple {8676#true} assume true; {8676#true} is VALID [2018-11-23 10:48:52,000 INFO L268 TraceCheckUtils]: 9: Hoare quadruple {8676#true} {8676#true} #717#return; {8676#true} is VALID [2018-11-23 10:48:52,000 INFO L273 TraceCheckUtils]: 10: Hoare triple {8676#true} assume ~bvsge32(~status~1, 0bv32);~s~0 := ~NP~0;~customIrp~0 := 0bv32;~setEventCalled~0 := ~customIrp~0;~lowerDriverReturn~0 := ~setEventCalled~0;~compRegistered~0 := ~lowerDriverReturn~0;~pended~0 := ~compRegistered~0;~pirp__IoStatus__Status~0 := 0bv32;~myStatus~0 := 0bv32; {8676#true} is VALID [2018-11-23 10:48:52,000 INFO L273 TraceCheckUtils]: 11: Hoare triple {8676#true} assume !(0bv32 == ~irp_choice~0); {8676#true} is VALID [2018-11-23 10:48:52,000 INFO L256 TraceCheckUtils]: 12: Hoare triple {8676#true} call stub_driver_init(); {8676#true} is VALID [2018-11-23 10:48:52,000 INFO L273 TraceCheckUtils]: 13: Hoare triple {8676#true} ~s~0 := ~NP~0;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32; {8676#true} is VALID [2018-11-23 10:48:52,000 INFO L273 TraceCheckUtils]: 14: Hoare triple {8676#true} assume true; {8676#true} is VALID [2018-11-23 10:48:52,001 INFO L268 TraceCheckUtils]: 15: Hoare quadruple {8676#true} {8676#true} #719#return; {8676#true} is VALID [2018-11-23 10:48:52,001 INFO L273 TraceCheckUtils]: 16: Hoare triple {8676#true} assume !~bvslt32(~status~1, 0bv32);havoc ~tmp_ndt_1~0;~tmp_ndt_1~0 := #t~nondet20;havoc #t~nondet20; {8676#true} is VALID [2018-11-23 10:48:52,001 INFO L273 TraceCheckUtils]: 17: Hoare triple {8676#true} assume !(0bv32 == ~tmp_ndt_1~0);havoc ~tmp_ndt_2~0;~tmp_ndt_2~0 := #t~nondet21;havoc #t~nondet21; {8676#true} is VALID [2018-11-23 10:48:52,001 INFO L273 TraceCheckUtils]: 18: Hoare triple {8676#true} assume !(1bv32 == ~tmp_ndt_2~0);havoc ~tmp_ndt_3~0;~tmp_ndt_3~0 := #t~nondet22;havoc #t~nondet22; {8676#true} is VALID [2018-11-23 10:48:52,001 INFO L273 TraceCheckUtils]: 19: Hoare triple {8676#true} assume 3bv32 == ~tmp_ndt_3~0; {8676#true} is VALID [2018-11-23 10:48:52,001 INFO L256 TraceCheckUtils]: 20: Hoare triple {8676#true} call #t~ret27 := KbFilter_PnP(~devobj~0, ~pirp~0); {8676#true} is VALID [2018-11-23 10:48:52,002 INFO L273 TraceCheckUtils]: 21: Hoare triple {8676#true} ~DeviceObject := #in~DeviceObject;~Irp := #in~Irp;havoc ~devExt~0;havoc ~irpStack~0;havoc ~status~0;~event~0 := #t~nondet0;havoc #t~nondet0;~DeviceObject__DeviceExtension~0 := #t~nondet1;havoc #t~nondet1;~Irp__Tail__Overlay__CurrentStackLocation~0 := #t~nondet2;havoc #t~nondet2;~irpStack__MinorFunction~0 := #t~nondet3;havoc #t~nondet3;~devExt__TopOfStack~0 := #t~nondet4;havoc #t~nondet4;havoc ~devExt__Started~0;havoc ~devExt__Removed~0;havoc ~devExt__SurpriseRemoved~0;havoc ~Irp__IoStatus__Status~0;havoc ~Irp__IoStatus__Information~0;~Irp__CurrentLocation~0 := #t~nondet5;havoc #t~nondet5;havoc ~irpSp~0;havoc ~nextIrpSp~0;havoc ~nextIrpSp__Control~0;havoc ~irpSp___0~0;havoc ~irpSp__Context~0;havoc ~irpSp__Control~0;havoc ~__cil_tmp23~0;~status~0 := 0bv32;~devExt~0 := ~DeviceObject__DeviceExtension~0;~irpStack~0 := ~Irp__Tail__Overlay__CurrentStackLocation~0; {8676#true} is VALID [2018-11-23 10:48:52,002 INFO L273 TraceCheckUtils]: 22: Hoare triple {8676#true} assume 0bv32 == ~irpStack__MinorFunction~0; {8676#true} is VALID [2018-11-23 10:48:52,002 INFO L273 TraceCheckUtils]: 23: Hoare triple {8676#true} ~irpSp~0 := ~Irp__Tail__Overlay__CurrentStackLocation~0;~nextIrpSp~0 := ~bvsub32(~Irp__Tail__Overlay__CurrentStackLocation~0, 1bv32);~nextIrpSp__Control~0 := 0bv32; {8676#true} is VALID [2018-11-23 10:48:52,002 INFO L273 TraceCheckUtils]: 24: Hoare triple {8676#true} assume !(~s~0 != ~NP~0); {8676#true} is VALID [2018-11-23 10:48:52,004 INFO L273 TraceCheckUtils]: 25: Hoare triple {8676#true} assume !(0bv32 != ~compRegistered~0);~compRegistered~0 := 1bv32; {8756#(= (_ bv1 32) ~compRegistered~0)} is VALID [2018-11-23 10:48:52,005 INFO L273 TraceCheckUtils]: 26: Hoare triple {8756#(= (_ bv1 32) ~compRegistered~0)} ~irpSp___0~0 := ~bvsub32(~Irp__Tail__Overlay__CurrentStackLocation~0, 1bv32);~irpSp__Context~0 := ~event~0;~irpSp__Control~0 := 224bv32; {8756#(= (_ bv1 32) ~compRegistered~0)} is VALID [2018-11-23 10:48:52,006 INFO L256 TraceCheckUtils]: 27: Hoare triple {8756#(= (_ bv1 32) ~compRegistered~0)} call #t~ret6 := IofCallDriver(~devExt__TopOfStack~0, ~Irp); {8756#(= (_ bv1 32) ~compRegistered~0)} is VALID [2018-11-23 10:48:52,025 INFO L273 TraceCheckUtils]: 28: Hoare triple {8756#(= (_ bv1 32) ~compRegistered~0)} ~DeviceObject := #in~DeviceObject;~Irp := #in~Irp;havoc ~returnVal2~0;havoc ~compRetStatus~0;~lcontext~0 := #t~nondet30;havoc #t~nondet30;havoc ~__cil_tmp7~0; {8756#(= (_ bv1 32) ~compRegistered~0)} is VALID [2018-11-23 10:48:52,034 INFO L273 TraceCheckUtils]: 29: Hoare triple {8756#(= (_ bv1 32) ~compRegistered~0)} assume !(0bv32 != ~compRegistered~0); {8677#false} is VALID [2018-11-23 10:48:52,034 INFO L273 TraceCheckUtils]: 30: Hoare triple {8677#false} havoc ~tmp_ndt_6~0;~tmp_ndt_6~0 := #t~nondet32;havoc #t~nondet32; {8677#false} is VALID [2018-11-23 10:48:52,034 INFO L273 TraceCheckUtils]: 31: Hoare triple {8677#false} assume 0bv32 == ~tmp_ndt_6~0; {8677#false} is VALID [2018-11-23 10:48:52,034 INFO L273 TraceCheckUtils]: 32: Hoare triple {8677#false} ~returnVal2~0 := 0bv32; {8677#false} is VALID [2018-11-23 10:48:52,035 INFO L273 TraceCheckUtils]: 33: Hoare triple {8677#false} assume ~s~0 == ~NP~0;~s~0 := ~IPC~0;~lowerDriverReturn~0 := ~returnVal2~0; {8677#false} is VALID [2018-11-23 10:48:52,035 INFO L273 TraceCheckUtils]: 34: Hoare triple {8677#false} #res := ~returnVal2~0; {8677#false} is VALID [2018-11-23 10:48:52,035 INFO L273 TraceCheckUtils]: 35: Hoare triple {8677#false} assume true; {8677#false} is VALID [2018-11-23 10:48:52,035 INFO L268 TraceCheckUtils]: 36: Hoare quadruple {8677#false} {8756#(= (_ bv1 32) ~compRegistered~0)} #771#return; {8677#false} is VALID [2018-11-23 10:48:52,036 INFO L273 TraceCheckUtils]: 37: Hoare triple {8677#false} ~status~0 := #t~ret6;havoc #t~ret6;~__cil_tmp23~0 := ~status~0; {8677#false} is VALID [2018-11-23 10:48:52,036 INFO L273 TraceCheckUtils]: 38: Hoare triple {8677#false} assume !(259bv32 == ~__cil_tmp23~0); {8677#false} is VALID [2018-11-23 10:48:52,036 INFO L273 TraceCheckUtils]: 39: Hoare triple {8677#false} assume !~bvsge32(~status~0, 0bv32); {8677#false} is VALID [2018-11-23 10:48:52,036 INFO L273 TraceCheckUtils]: 40: Hoare triple {8677#false} ~Irp__IoStatus__Status~0 := ~status~0;~myStatus~0 := ~status~0;~Irp__IoStatus__Information~0 := 0bv32; {8677#false} is VALID [2018-11-23 10:48:52,037 INFO L256 TraceCheckUtils]: 41: Hoare triple {8677#false} call IofCompleteRequest(~Irp, 0bv32); {8677#false} is VALID [2018-11-23 10:48:52,037 INFO L273 TraceCheckUtils]: 42: Hoare triple {8677#false} ~Irp := #in~Irp;~PriorityBoost := #in~PriorityBoost; {8677#false} is VALID [2018-11-23 10:48:52,037 INFO L273 TraceCheckUtils]: 43: Hoare triple {8677#false} assume !(~s~0 == ~NP~0); {8677#false} is VALID [2018-11-23 10:48:52,037 INFO L256 TraceCheckUtils]: 44: Hoare triple {8677#false} call errorFn(); {8677#false} is VALID [2018-11-23 10:48:52,037 INFO L273 TraceCheckUtils]: 45: Hoare triple {8677#false} assume !false; {8677#false} is VALID [2018-11-23 10:48:52,039 INFO L134 CoverageAnalysis]: Checked inductivity of 0 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 0 trivial. 0 not checked. [2018-11-23 10:48:52,039 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-23 10:48:52,041 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 10:48:52,042 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-23 10:48:52,042 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 46 [2018-11-23 10:48:52,042 INFO L84 Accepts]: Finished accepts. word is accepted. [2018-11-23 10:48:52,042 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 3 states. [2018-11-23 10:48:52,131 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 46 edges. 46 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:48:52,131 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-23 10:48:52,132 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-23 10:48:52,132 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 10:48:52,132 INFO L87 Difference]: Start difference. First operand 349 states and 472 transitions. Second operand 3 states. [2018-11-23 10:48:53,405 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:48:53,406 INFO L93 Difference]: Finished difference Result 400 states and 529 transitions. [2018-11-23 10:48:53,406 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-23 10:48:53,406 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 46 [2018-11-23 10:48:53,406 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 10:48:53,406 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 3 states. [2018-11-23 10:48:53,410 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 3 states to 3 states and 418 transitions. [2018-11-23 10:48:53,410 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 3 states. [2018-11-23 10:48:53,414 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 3 states to 3 states and 418 transitions. [2018-11-23 10:48:53,414 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 3 states and 418 transitions. [2018-11-23 10:48:54,590 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 418 edges. 418 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:48:54,599 INFO L225 Difference]: With dead ends: 400 [2018-11-23 10:48:54,600 INFO L226 Difference]: Without dead ends: 329 [2018-11-23 10:48:54,600 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 45 GetRequests, 43 SyntacticMatches, 1 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 10:48:54,601 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 329 states. [2018-11-23 10:48:54,825 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 329 to 308. [2018-11-23 10:48:54,825 INFO L214 AbstractMinimizeNwa]: Start testing correctness of minimizeSevpa [2018-11-23 10:48:54,826 INFO L82 GeneralOperation]: Start isEquivalent. First operand 329 states. Second operand 308 states. [2018-11-23 10:48:54,826 INFO L74 IsIncluded]: Start isIncluded. First operand 329 states. Second operand 308 states. [2018-11-23 10:48:54,826 INFO L87 Difference]: Start difference. First operand 329 states. Second operand 308 states. [2018-11-23 10:48:54,838 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:48:54,839 INFO L93 Difference]: Finished difference Result 329 states and 437 transitions. [2018-11-23 10:48:54,839 INFO L276 IsEmpty]: Start isEmpty. Operand 329 states and 437 transitions. [2018-11-23 10:48:54,840 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:48:54,840 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:48:54,840 INFO L74 IsIncluded]: Start isIncluded. First operand 308 states. Second operand 329 states. [2018-11-23 10:48:54,841 INFO L87 Difference]: Start difference. First operand 308 states. Second operand 329 states. [2018-11-23 10:48:54,852 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:48:54,852 INFO L93 Difference]: Finished difference Result 329 states and 437 transitions. [2018-11-23 10:48:54,852 INFO L276 IsEmpty]: Start isEmpty. Operand 329 states and 437 transitions. [2018-11-23 10:48:54,853 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:48:54,853 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:48:54,854 INFO L88 GeneralOperation]: Finished isEquivalent. [2018-11-23 10:48:54,854 INFO L221 AbstractMinimizeNwa]: Finished testing correctness of minimizeSevpa [2018-11-23 10:48:54,854 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 308 states. [2018-11-23 10:48:54,866 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 308 states to 308 states and 412 transitions. [2018-11-23 10:48:54,867 INFO L78 Accepts]: Start accepts. Automaton has 308 states and 412 transitions. Word has length 46 [2018-11-23 10:48:54,867 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 10:48:54,867 INFO L480 AbstractCegarLoop]: Abstraction has 308 states and 412 transitions. [2018-11-23 10:48:54,867 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-23 10:48:54,868 INFO L276 IsEmpty]: Start isEmpty. Operand 308 states and 412 transitions. [2018-11-23 10:48:54,869 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 46 [2018-11-23 10:48:54,869 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 10:48:54,870 INFO L402 BasicCegarLoop]: trace histogram [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 10:48:54,870 INFO L423 AbstractCegarLoop]: === Iteration 7 === [errorFnErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 10:48:54,870 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 10:48:54,870 INFO L82 PathProgramCache]: Analyzing trace with hash 750041855, now seen corresponding path program 1 times [2018-11-23 10:48:54,871 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 10:48:54,871 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/cvc4nyu Starting monitored process 8 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 8 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 10:48:54,896 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 10:48:54,985 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:48:55,029 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:48:55,031 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 10:48:55,526 INFO L256 TraceCheckUtils]: 0: Hoare triple {10408#true} call ULTIMATE.init(); {10408#true} is VALID [2018-11-23 10:48:55,527 INFO L273 TraceCheckUtils]: 1: Hoare triple {10408#true} ~KernelMode~0 := 0bv32;~Executive~0 := 0bv32;~DevicePowerState~0 := 0bv32;~s~0 := 0bv32;~UNLOADED~0 := 0bv32;~NP~0 := 0bv32;~DC~0 := 0bv32;~SKIP1~0 := 0bv32;~SKIP2~0 := 0bv32;~MPR1~0 := 0bv32;~MPR3~0 := 0bv32;~IPC~0 := 0bv32;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32;~myStatus~0 := 0bv32; {10408#true} is VALID [2018-11-23 10:48:55,527 INFO L273 TraceCheckUtils]: 2: Hoare triple {10408#true} assume true; {10408#true} is VALID [2018-11-23 10:48:55,527 INFO L268 TraceCheckUtils]: 3: Hoare quadruple {10408#true} {10408#true} #759#return; {10408#true} is VALID [2018-11-23 10:48:55,527 INFO L256 TraceCheckUtils]: 4: Hoare triple {10408#true} call #t~ret77 := main(); {10408#true} is VALID [2018-11-23 10:48:55,527 INFO L273 TraceCheckUtils]: 5: Hoare triple {10408#true} havoc ~status~1;~irp~0 := #t~nondet17;havoc #t~nondet17;havoc ~pirp~0;havoc ~pirp__IoStatus__Status~0;~irp_choice~0 := #t~nondet18;havoc #t~nondet18;~devobj~0 := #t~nondet19;havoc #t~nondet19;havoc ~__cil_tmp8~0;~KernelMode~0 := 0bv32;~Executive~0 := 0bv32;~DevicePowerState~0 := 1bv32;~s~0 := 0bv32;~UNLOADED~0 := 0bv32;~NP~0 := 0bv32;~DC~0 := 0bv32;~SKIP1~0 := 0bv32;~SKIP2~0 := 0bv32;~MPR1~0 := 0bv32;~MPR3~0 := 0bv32;~IPC~0 := 0bv32;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32;~myStatus~0 := 0bv32;~status~1 := 0bv32;~pirp~0 := ~irp~0; {10408#true} is VALID [2018-11-23 10:48:55,528 INFO L256 TraceCheckUtils]: 6: Hoare triple {10408#true} call _BLAST_init(); {10408#true} is VALID [2018-11-23 10:48:55,528 INFO L273 TraceCheckUtils]: 7: Hoare triple {10408#true} ~UNLOADED~0 := 0bv32;~NP~0 := 1bv32;~DC~0 := 2bv32;~SKIP1~0 := 3bv32;~SKIP2~0 := 4bv32;~MPR1~0 := 5bv32;~MPR3~0 := 6bv32;~IPC~0 := 7bv32;~s~0 := ~UNLOADED~0;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32; {10408#true} is VALID [2018-11-23 10:48:55,528 INFO L273 TraceCheckUtils]: 8: Hoare triple {10408#true} assume true; {10408#true} is VALID [2018-11-23 10:48:55,528 INFO L268 TraceCheckUtils]: 9: Hoare quadruple {10408#true} {10408#true} #717#return; {10408#true} is VALID [2018-11-23 10:48:55,529 INFO L273 TraceCheckUtils]: 10: Hoare triple {10408#true} assume ~bvsge32(~status~1, 0bv32);~s~0 := ~NP~0;~customIrp~0 := 0bv32;~setEventCalled~0 := ~customIrp~0;~lowerDriverReturn~0 := ~setEventCalled~0;~compRegistered~0 := ~lowerDriverReturn~0;~pended~0 := ~compRegistered~0;~pirp__IoStatus__Status~0 := 0bv32;~myStatus~0 := 0bv32; {10408#true} is VALID [2018-11-23 10:48:55,529 INFO L273 TraceCheckUtils]: 11: Hoare triple {10408#true} assume !(0bv32 == ~irp_choice~0); {10408#true} is VALID [2018-11-23 10:48:55,529 INFO L256 TraceCheckUtils]: 12: Hoare triple {10408#true} call stub_driver_init(); {10408#true} is VALID [2018-11-23 10:48:55,529 INFO L273 TraceCheckUtils]: 13: Hoare triple {10408#true} ~s~0 := ~NP~0;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32; {10408#true} is VALID [2018-11-23 10:48:55,530 INFO L273 TraceCheckUtils]: 14: Hoare triple {10408#true} assume true; {10408#true} is VALID [2018-11-23 10:48:55,530 INFO L268 TraceCheckUtils]: 15: Hoare quadruple {10408#true} {10408#true} #719#return; {10408#true} is VALID [2018-11-23 10:48:55,530 INFO L273 TraceCheckUtils]: 16: Hoare triple {10408#true} assume !~bvslt32(~status~1, 0bv32);havoc ~tmp_ndt_1~0;~tmp_ndt_1~0 := #t~nondet20;havoc #t~nondet20; {10408#true} is VALID [2018-11-23 10:48:55,530 INFO L273 TraceCheckUtils]: 17: Hoare triple {10408#true} assume !(0bv32 == ~tmp_ndt_1~0);havoc ~tmp_ndt_2~0;~tmp_ndt_2~0 := #t~nondet21;havoc #t~nondet21; {10408#true} is VALID [2018-11-23 10:48:55,530 INFO L273 TraceCheckUtils]: 18: Hoare triple {10408#true} assume !(1bv32 == ~tmp_ndt_2~0);havoc ~tmp_ndt_3~0;~tmp_ndt_3~0 := #t~nondet22;havoc #t~nondet22; {10408#true} is VALID [2018-11-23 10:48:55,531 INFO L273 TraceCheckUtils]: 19: Hoare triple {10408#true} assume !(3bv32 == ~tmp_ndt_3~0);havoc ~tmp_ndt_4~0;~tmp_ndt_4~0 := #t~nondet23;havoc #t~nondet23; {10408#true} is VALID [2018-11-23 10:48:55,531 INFO L273 TraceCheckUtils]: 20: Hoare triple {10408#true} assume !(4bv32 == ~tmp_ndt_4~0);havoc ~tmp_ndt_5~0;~tmp_ndt_5~0 := #t~nondet24;havoc #t~nondet24; {10408#true} is VALID [2018-11-23 10:48:55,531 INFO L273 TraceCheckUtils]: 21: Hoare triple {10408#true} assume 8bv32 == ~tmp_ndt_5~0; {10408#true} is VALID [2018-11-23 10:48:55,531 INFO L256 TraceCheckUtils]: 22: Hoare triple {10408#true} call #t~ret29 := KbFilter_InternIoCtl(~devobj~0, ~pirp~0); {10408#true} is VALID [2018-11-23 10:48:55,532 INFO L273 TraceCheckUtils]: 23: Hoare triple {10408#true} ~DeviceObject := #in~DeviceObject;~Irp := #in~Irp;havoc ~Irp__IoStatus__Information~1;~irpStack__Parameters__DeviceIoControl__IoControlCode~0 := #t~nondet59;havoc #t~nondet59;~devExt__UpperConnectData__ClassService~1 := #t~nondet60;havoc #t~nondet60;~irpStack__Parameters__DeviceIoControl__InputBufferLength~0 := #t~nondet61;havoc #t~nondet61;~sizeof__CONNECT_DATA~0 := #t~nondet62;havoc #t~nondet62;~irpStack__Parameters__DeviceIoControl__Type3InputBuffer~0 := #t~nondet63;havoc #t~nondet63;~sizeof__INTERNAL_I8042_HOOK_KEYBOARD~0 := #t~nondet64;havoc #t~nondet64;~hookKeyboard__InitializationRoutine~0 := #t~nondet65;havoc #t~nondet65;~hookKeyboard__IsrRoutine~0 := #t~nondet66;havoc #t~nondet66;havoc ~Irp__IoStatus__Status~2;havoc ~hookKeyboard~0;havoc ~connectData~0;havoc ~status~3;havoc ~tmp~3;havoc ~__cil_tmp17~0;havoc ~__cil_tmp18~0;havoc ~__cil_tmp19~0;~__cil_tmp20~0 := #t~nondet67;havoc #t~nondet67;havoc ~__cil_tmp21~0;havoc ~__cil_tmp22~0;havoc ~__cil_tmp23~1;~__cil_tmp24~0 := #t~nondet68;havoc #t~nondet68;havoc ~__cil_tmp25~0;havoc ~__cil_tmp26~0;havoc ~__cil_tmp27~0;~__cil_tmp28~0 := #t~nondet69;havoc #t~nondet69;~__cil_tmp29~0 := #t~nondet70;havoc #t~nondet70;havoc ~__cil_tmp30~0;havoc ~__cil_tmp31~0;~__cil_tmp32~0 := #t~nondet71;havoc #t~nondet71;havoc ~__cil_tmp33~0;havoc ~__cil_tmp34~0;~__cil_tmp35~0 := #t~nondet72;havoc #t~nondet72;havoc ~__cil_tmp36~0;havoc ~__cil_tmp37~0;~__cil_tmp38~0 := #t~nondet73;havoc #t~nondet73;havoc ~__cil_tmp39~0;havoc ~__cil_tmp40~0;~__cil_tmp41~0 := #t~nondet74;havoc #t~nondet74;havoc ~__cil_tmp42~0;havoc ~__cil_tmp43~0;~__cil_tmp44~0 := #t~nondet75;havoc #t~nondet75;havoc ~__cil_tmp45~0;~status~3 := 0bv32;~Irp__IoStatus__Information~1 := 0bv32; {10408#true} is VALID [2018-11-23 10:48:55,532 INFO L273 TraceCheckUtils]: 24: Hoare triple {10408#true} assume ~irpStack__Parameters__DeviceIoControl__IoControlCode~0 == ~__cil_tmp20~0; {10408#true} is VALID [2018-11-23 10:48:55,532 INFO L273 TraceCheckUtils]: 25: Hoare triple {10408#true} assume 0bv32 != ~devExt__UpperConnectData__ClassService~1;~status~3 := 3221225539bv32; {10408#true} is VALID [2018-11-23 10:48:55,533 INFO L273 TraceCheckUtils]: 26: Hoare triple {10408#true} assume ~bvslt32(~status~3, 0bv32);~Irp__IoStatus__Status~2 := ~status~3;~myStatus~0 := ~status~3; {10408#true} is VALID [2018-11-23 10:48:55,533 INFO L256 TraceCheckUtils]: 27: Hoare triple {10408#true} call IofCompleteRequest(~Irp, 0bv32); {10408#true} is VALID [2018-11-23 10:48:55,533 INFO L273 TraceCheckUtils]: 28: Hoare triple {10408#true} ~Irp := #in~Irp;~PriorityBoost := #in~PriorityBoost; {10408#true} is VALID [2018-11-23 10:48:55,533 INFO L273 TraceCheckUtils]: 29: Hoare triple {10408#true} assume ~s~0 == ~NP~0;~s~0 := ~DC~0; {10408#true} is VALID [2018-11-23 10:48:55,534 INFO L273 TraceCheckUtils]: 30: Hoare triple {10408#true} assume true; {10408#true} is VALID [2018-11-23 10:48:55,534 INFO L268 TraceCheckUtils]: 31: Hoare quadruple {10408#true} {10408#true} #751#return; {10408#true} is VALID [2018-11-23 10:48:55,534 INFO L273 TraceCheckUtils]: 32: Hoare triple {10408#true} #res := ~status~3; {10408#true} is VALID [2018-11-23 10:48:55,534 INFO L273 TraceCheckUtils]: 33: Hoare triple {10408#true} assume true; {10408#true} is VALID [2018-11-23 10:48:55,534 INFO L268 TraceCheckUtils]: 34: Hoare quadruple {10408#true} {10408#true} #729#return; {10408#true} is VALID [2018-11-23 10:48:55,535 INFO L273 TraceCheckUtils]: 35: Hoare triple {10408#true} ~status~1 := #t~ret29;havoc #t~ret29; {10408#true} is VALID [2018-11-23 10:48:55,541 INFO L273 TraceCheckUtils]: 36: Hoare triple {10408#true} assume !(1bv32 == ~pended~0); {10521#(not (= (_ bv1 32) ~pended~0))} is VALID [2018-11-23 10:48:55,542 INFO L273 TraceCheckUtils]: 37: Hoare triple {10521#(not (= (_ bv1 32) ~pended~0))} assume !(1bv32 == ~pended~0); {10521#(not (= (_ bv1 32) ~pended~0))} is VALID [2018-11-23 10:48:55,543 INFO L273 TraceCheckUtils]: 38: Hoare triple {10521#(not (= (_ bv1 32) ~pended~0))} assume ~s~0 != ~UNLOADED~0; {10521#(not (= (_ bv1 32) ~pended~0))} is VALID [2018-11-23 10:48:55,543 INFO L273 TraceCheckUtils]: 39: Hoare triple {10521#(not (= (_ bv1 32) ~pended~0))} assume 4294967295bv32 != ~status~1; {10521#(not (= (_ bv1 32) ~pended~0))} is VALID [2018-11-23 10:48:55,545 INFO L273 TraceCheckUtils]: 40: Hoare triple {10521#(not (= (_ bv1 32) ~pended~0))} assume !(~s~0 != ~SKIP2~0); {10521#(not (= (_ bv1 32) ~pended~0))} is VALID [2018-11-23 10:48:55,545 INFO L273 TraceCheckUtils]: 41: Hoare triple {10521#(not (= (_ bv1 32) ~pended~0))} assume 1bv32 == ~pended~0; {10409#false} is VALID [2018-11-23 10:48:55,545 INFO L273 TraceCheckUtils]: 42: Hoare triple {10409#false} assume 259bv32 != ~status~1; {10409#false} is VALID [2018-11-23 10:48:55,545 INFO L256 TraceCheckUtils]: 43: Hoare triple {10409#false} call errorFn(); {10409#false} is VALID [2018-11-23 10:48:55,546 INFO L273 TraceCheckUtils]: 44: Hoare triple {10409#false} assume !false; {10409#false} is VALID [2018-11-23 10:48:55,547 INFO L134 CoverageAnalysis]: Checked inductivity of 0 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 0 trivial. 0 not checked. [2018-11-23 10:48:55,547 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-23 10:48:55,549 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 10:48:55,549 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-23 10:48:55,549 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 45 [2018-11-23 10:48:55,550 INFO L84 Accepts]: Finished accepts. word is accepted. [2018-11-23 10:48:55,550 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 3 states. [2018-11-23 10:48:55,603 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 45 edges. 45 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:48:55,603 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-23 10:48:55,603 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-23 10:48:55,604 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 10:48:55,604 INFO L87 Difference]: Start difference. First operand 308 states and 412 transitions. Second operand 3 states. [2018-11-23 10:48:56,407 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:48:56,407 INFO L93 Difference]: Finished difference Result 320 states and 427 transitions. [2018-11-23 10:48:56,408 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-23 10:48:56,408 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 45 [2018-11-23 10:48:56,408 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 10:48:56,408 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 3 states. [2018-11-23 10:48:56,411 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 3 states to 3 states and 315 transitions. [2018-11-23 10:48:56,411 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 3 states. [2018-11-23 10:48:56,414 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 3 states to 3 states and 315 transitions. [2018-11-23 10:48:56,414 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 3 states and 315 transitions. [2018-11-23 10:48:57,166 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 315 edges. 315 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:48:57,174 INFO L225 Difference]: With dead ends: 320 [2018-11-23 10:48:57,174 INFO L226 Difference]: Without dead ends: 304 [2018-11-23 10:48:57,175 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 44 GetRequests, 43 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 10:48:57,175 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 304 states. [2018-11-23 10:48:57,555 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 304 to 274. [2018-11-23 10:48:57,555 INFO L214 AbstractMinimizeNwa]: Start testing correctness of minimizeSevpa [2018-11-23 10:48:57,555 INFO L82 GeneralOperation]: Start isEquivalent. First operand 304 states. Second operand 274 states. [2018-11-23 10:48:57,555 INFO L74 IsIncluded]: Start isIncluded. First operand 304 states. Second operand 274 states. [2018-11-23 10:48:57,555 INFO L87 Difference]: Start difference. First operand 304 states. Second operand 274 states. [2018-11-23 10:48:57,565 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:48:57,565 INFO L93 Difference]: Finished difference Result 304 states and 405 transitions. [2018-11-23 10:48:57,565 INFO L276 IsEmpty]: Start isEmpty. Operand 304 states and 405 transitions. [2018-11-23 10:48:57,566 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:48:57,566 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:48:57,567 INFO L74 IsIncluded]: Start isIncluded. First operand 274 states. Second operand 304 states. [2018-11-23 10:48:57,567 INFO L87 Difference]: Start difference. First operand 274 states. Second operand 304 states. [2018-11-23 10:48:57,575 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:48:57,575 INFO L93 Difference]: Finished difference Result 304 states and 405 transitions. [2018-11-23 10:48:57,575 INFO L276 IsEmpty]: Start isEmpty. Operand 304 states and 405 transitions. [2018-11-23 10:48:57,577 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:48:57,577 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:48:57,577 INFO L88 GeneralOperation]: Finished isEquivalent. [2018-11-23 10:48:57,577 INFO L221 AbstractMinimizeNwa]: Finished testing correctness of minimizeSevpa [2018-11-23 10:48:57,577 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 274 states. [2018-11-23 10:48:57,585 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 274 states to 274 states and 370 transitions. [2018-11-23 10:48:57,585 INFO L78 Accepts]: Start accepts. Automaton has 274 states and 370 transitions. Word has length 45 [2018-11-23 10:48:57,585 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 10:48:57,585 INFO L480 AbstractCegarLoop]: Abstraction has 274 states and 370 transitions. [2018-11-23 10:48:57,586 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-23 10:48:57,586 INFO L276 IsEmpty]: Start isEmpty. Operand 274 states and 370 transitions. [2018-11-23 10:48:57,587 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 47 [2018-11-23 10:48:57,587 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 10:48:57,587 INFO L402 BasicCegarLoop]: trace histogram [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 10:48:57,587 INFO L423 AbstractCegarLoop]: === Iteration 8 === [errorFnErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 10:48:57,587 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 10:48:57,587 INFO L82 PathProgramCache]: Analyzing trace with hash 1784783245, now seen corresponding path program 1 times [2018-11-23 10:48:57,588 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 10:48:57,588 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/cvc4nyu Starting monitored process 9 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 9 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 10:48:57,613 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 10:48:57,699 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:48:57,736 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:48:57,738 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 10:48:57,813 INFO L256 TraceCheckUtils]: 0: Hoare triple {11941#true} call ULTIMATE.init(); {11941#true} is VALID [2018-11-23 10:48:57,814 INFO L273 TraceCheckUtils]: 1: Hoare triple {11941#true} ~KernelMode~0 := 0bv32;~Executive~0 := 0bv32;~DevicePowerState~0 := 0bv32;~s~0 := 0bv32;~UNLOADED~0 := 0bv32;~NP~0 := 0bv32;~DC~0 := 0bv32;~SKIP1~0 := 0bv32;~SKIP2~0 := 0bv32;~MPR1~0 := 0bv32;~MPR3~0 := 0bv32;~IPC~0 := 0bv32;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32;~myStatus~0 := 0bv32; {11941#true} is VALID [2018-11-23 10:48:57,814 INFO L273 TraceCheckUtils]: 2: Hoare triple {11941#true} assume true; {11941#true} is VALID [2018-11-23 10:48:57,815 INFO L268 TraceCheckUtils]: 3: Hoare quadruple {11941#true} {11941#true} #759#return; {11941#true} is VALID [2018-11-23 10:48:57,815 INFO L256 TraceCheckUtils]: 4: Hoare triple {11941#true} call #t~ret77 := main(); {11941#true} is VALID [2018-11-23 10:48:57,816 INFO L273 TraceCheckUtils]: 5: Hoare triple {11941#true} havoc ~status~1;~irp~0 := #t~nondet17;havoc #t~nondet17;havoc ~pirp~0;havoc ~pirp__IoStatus__Status~0;~irp_choice~0 := #t~nondet18;havoc #t~nondet18;~devobj~0 := #t~nondet19;havoc #t~nondet19;havoc ~__cil_tmp8~0;~KernelMode~0 := 0bv32;~Executive~0 := 0bv32;~DevicePowerState~0 := 1bv32;~s~0 := 0bv32;~UNLOADED~0 := 0bv32;~NP~0 := 0bv32;~DC~0 := 0bv32;~SKIP1~0 := 0bv32;~SKIP2~0 := 0bv32;~MPR1~0 := 0bv32;~MPR3~0 := 0bv32;~IPC~0 := 0bv32;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32;~myStatus~0 := 0bv32;~status~1 := 0bv32;~pirp~0 := ~irp~0; {11941#true} is VALID [2018-11-23 10:48:57,816 INFO L256 TraceCheckUtils]: 6: Hoare triple {11941#true} call _BLAST_init(); {11941#true} is VALID [2018-11-23 10:48:57,816 INFO L273 TraceCheckUtils]: 7: Hoare triple {11941#true} ~UNLOADED~0 := 0bv32;~NP~0 := 1bv32;~DC~0 := 2bv32;~SKIP1~0 := 3bv32;~SKIP2~0 := 4bv32;~MPR1~0 := 5bv32;~MPR3~0 := 6bv32;~IPC~0 := 7bv32;~s~0 := ~UNLOADED~0;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32; {11941#true} is VALID [2018-11-23 10:48:57,816 INFO L273 TraceCheckUtils]: 8: Hoare triple {11941#true} assume true; {11941#true} is VALID [2018-11-23 10:48:57,817 INFO L268 TraceCheckUtils]: 9: Hoare quadruple {11941#true} {11941#true} #717#return; {11941#true} is VALID [2018-11-23 10:48:57,817 INFO L273 TraceCheckUtils]: 10: Hoare triple {11941#true} assume ~bvsge32(~status~1, 0bv32);~s~0 := ~NP~0;~customIrp~0 := 0bv32;~setEventCalled~0 := ~customIrp~0;~lowerDriverReturn~0 := ~setEventCalled~0;~compRegistered~0 := ~lowerDriverReturn~0;~pended~0 := ~compRegistered~0;~pirp__IoStatus__Status~0 := 0bv32;~myStatus~0 := 0bv32; {11941#true} is VALID [2018-11-23 10:48:57,817 INFO L273 TraceCheckUtils]: 11: Hoare triple {11941#true} assume !(0bv32 == ~irp_choice~0); {11941#true} is VALID [2018-11-23 10:48:57,817 INFO L256 TraceCheckUtils]: 12: Hoare triple {11941#true} call stub_driver_init(); {11941#true} is VALID [2018-11-23 10:48:57,818 INFO L273 TraceCheckUtils]: 13: Hoare triple {11941#true} ~s~0 := ~NP~0;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32; {11941#true} is VALID [2018-11-23 10:48:57,818 INFO L273 TraceCheckUtils]: 14: Hoare triple {11941#true} assume true; {11941#true} is VALID [2018-11-23 10:48:57,818 INFO L268 TraceCheckUtils]: 15: Hoare quadruple {11941#true} {11941#true} #719#return; {11941#true} is VALID [2018-11-23 10:48:57,818 INFO L273 TraceCheckUtils]: 16: Hoare triple {11941#true} assume !~bvslt32(~status~1, 0bv32);havoc ~tmp_ndt_1~0;~tmp_ndt_1~0 := #t~nondet20;havoc #t~nondet20; {11941#true} is VALID [2018-11-23 10:48:57,818 INFO L273 TraceCheckUtils]: 17: Hoare triple {11941#true} assume !(0bv32 == ~tmp_ndt_1~0);havoc ~tmp_ndt_2~0;~tmp_ndt_2~0 := #t~nondet21;havoc #t~nondet21; {11941#true} is VALID [2018-11-23 10:48:57,819 INFO L273 TraceCheckUtils]: 18: Hoare triple {11941#true} assume !(1bv32 == ~tmp_ndt_2~0);havoc ~tmp_ndt_3~0;~tmp_ndt_3~0 := #t~nondet22;havoc #t~nondet22; {11941#true} is VALID [2018-11-23 10:48:57,819 INFO L273 TraceCheckUtils]: 19: Hoare triple {11941#true} assume !(3bv32 == ~tmp_ndt_3~0);havoc ~tmp_ndt_4~0;~tmp_ndt_4~0 := #t~nondet23;havoc #t~nondet23; {11941#true} is VALID [2018-11-23 10:48:57,819 INFO L273 TraceCheckUtils]: 20: Hoare triple {11941#true} assume !(4bv32 == ~tmp_ndt_4~0);havoc ~tmp_ndt_5~0;~tmp_ndt_5~0 := #t~nondet24;havoc #t~nondet24; {11941#true} is VALID [2018-11-23 10:48:57,819 INFO L273 TraceCheckUtils]: 21: Hoare triple {11941#true} assume 8bv32 == ~tmp_ndt_5~0; {11941#true} is VALID [2018-11-23 10:48:57,820 INFO L256 TraceCheckUtils]: 22: Hoare triple {11941#true} call #t~ret29 := KbFilter_InternIoCtl(~devobj~0, ~pirp~0); {11941#true} is VALID [2018-11-23 10:48:57,820 INFO L273 TraceCheckUtils]: 23: Hoare triple {11941#true} ~DeviceObject := #in~DeviceObject;~Irp := #in~Irp;havoc ~Irp__IoStatus__Information~1;~irpStack__Parameters__DeviceIoControl__IoControlCode~0 := #t~nondet59;havoc #t~nondet59;~devExt__UpperConnectData__ClassService~1 := #t~nondet60;havoc #t~nondet60;~irpStack__Parameters__DeviceIoControl__InputBufferLength~0 := #t~nondet61;havoc #t~nondet61;~sizeof__CONNECT_DATA~0 := #t~nondet62;havoc #t~nondet62;~irpStack__Parameters__DeviceIoControl__Type3InputBuffer~0 := #t~nondet63;havoc #t~nondet63;~sizeof__INTERNAL_I8042_HOOK_KEYBOARD~0 := #t~nondet64;havoc #t~nondet64;~hookKeyboard__InitializationRoutine~0 := #t~nondet65;havoc #t~nondet65;~hookKeyboard__IsrRoutine~0 := #t~nondet66;havoc #t~nondet66;havoc ~Irp__IoStatus__Status~2;havoc ~hookKeyboard~0;havoc ~connectData~0;havoc ~status~3;havoc ~tmp~3;havoc ~__cil_tmp17~0;havoc ~__cil_tmp18~0;havoc ~__cil_tmp19~0;~__cil_tmp20~0 := #t~nondet67;havoc #t~nondet67;havoc ~__cil_tmp21~0;havoc ~__cil_tmp22~0;havoc ~__cil_tmp23~1;~__cil_tmp24~0 := #t~nondet68;havoc #t~nondet68;havoc ~__cil_tmp25~0;havoc ~__cil_tmp26~0;havoc ~__cil_tmp27~0;~__cil_tmp28~0 := #t~nondet69;havoc #t~nondet69;~__cil_tmp29~0 := #t~nondet70;havoc #t~nondet70;havoc ~__cil_tmp30~0;havoc ~__cil_tmp31~0;~__cil_tmp32~0 := #t~nondet71;havoc #t~nondet71;havoc ~__cil_tmp33~0;havoc ~__cil_tmp34~0;~__cil_tmp35~0 := #t~nondet72;havoc #t~nondet72;havoc ~__cil_tmp36~0;havoc ~__cil_tmp37~0;~__cil_tmp38~0 := #t~nondet73;havoc #t~nondet73;havoc ~__cil_tmp39~0;havoc ~__cil_tmp40~0;~__cil_tmp41~0 := #t~nondet74;havoc #t~nondet74;havoc ~__cil_tmp42~0;havoc ~__cil_tmp43~0;~__cil_tmp44~0 := #t~nondet75;havoc #t~nondet75;havoc ~__cil_tmp45~0;~status~3 := 0bv32;~Irp__IoStatus__Information~1 := 0bv32; {11941#true} is VALID [2018-11-23 10:48:57,820 INFO L273 TraceCheckUtils]: 24: Hoare triple {11941#true} assume ~irpStack__Parameters__DeviceIoControl__IoControlCode~0 == ~__cil_tmp20~0; {11941#true} is VALID [2018-11-23 10:48:57,820 INFO L273 TraceCheckUtils]: 25: Hoare triple {11941#true} assume 0bv32 != ~devExt__UpperConnectData__ClassService~1;~status~3 := 3221225539bv32; {11941#true} is VALID [2018-11-23 10:48:57,820 INFO L273 TraceCheckUtils]: 26: Hoare triple {11941#true} assume ~bvslt32(~status~3, 0bv32);~Irp__IoStatus__Status~2 := ~status~3;~myStatus~0 := ~status~3; {11941#true} is VALID [2018-11-23 10:48:57,821 INFO L256 TraceCheckUtils]: 27: Hoare triple {11941#true} call IofCompleteRequest(~Irp, 0bv32); {11941#true} is VALID [2018-11-23 10:48:57,821 INFO L273 TraceCheckUtils]: 28: Hoare triple {11941#true} ~Irp := #in~Irp;~PriorityBoost := #in~PriorityBoost; {11941#true} is VALID [2018-11-23 10:48:57,827 INFO L273 TraceCheckUtils]: 29: Hoare triple {11941#true} assume ~s~0 == ~NP~0;~s~0 := ~DC~0; {12033#(= ~DC~0 ~s~0)} is VALID [2018-11-23 10:48:57,828 INFO L273 TraceCheckUtils]: 30: Hoare triple {12033#(= ~DC~0 ~s~0)} assume true; {12033#(= ~DC~0 ~s~0)} is VALID [2018-11-23 10:48:57,829 INFO L268 TraceCheckUtils]: 31: Hoare quadruple {12033#(= ~DC~0 ~s~0)} {11941#true} #751#return; {12033#(= ~DC~0 ~s~0)} is VALID [2018-11-23 10:48:57,832 INFO L273 TraceCheckUtils]: 32: Hoare triple {12033#(= ~DC~0 ~s~0)} #res := ~status~3; {12033#(= ~DC~0 ~s~0)} is VALID [2018-11-23 10:48:57,832 INFO L273 TraceCheckUtils]: 33: Hoare triple {12033#(= ~DC~0 ~s~0)} assume true; {12033#(= ~DC~0 ~s~0)} is VALID [2018-11-23 10:48:57,834 INFO L268 TraceCheckUtils]: 34: Hoare quadruple {12033#(= ~DC~0 ~s~0)} {11941#true} #729#return; {12033#(= ~DC~0 ~s~0)} is VALID [2018-11-23 10:48:57,834 INFO L273 TraceCheckUtils]: 35: Hoare triple {12033#(= ~DC~0 ~s~0)} ~status~1 := #t~ret29;havoc #t~ret29; {12033#(= ~DC~0 ~s~0)} is VALID [2018-11-23 10:48:57,834 INFO L273 TraceCheckUtils]: 36: Hoare triple {12033#(= ~DC~0 ~s~0)} assume !(1bv32 == ~pended~0); {12033#(= ~DC~0 ~s~0)} is VALID [2018-11-23 10:48:57,835 INFO L273 TraceCheckUtils]: 37: Hoare triple {12033#(= ~DC~0 ~s~0)} assume !(1bv32 == ~pended~0); {12033#(= ~DC~0 ~s~0)} is VALID [2018-11-23 10:48:57,835 INFO L273 TraceCheckUtils]: 38: Hoare triple {12033#(= ~DC~0 ~s~0)} assume ~s~0 != ~UNLOADED~0; {12033#(= ~DC~0 ~s~0)} is VALID [2018-11-23 10:48:57,835 INFO L273 TraceCheckUtils]: 39: Hoare triple {12033#(= ~DC~0 ~s~0)} assume 4294967295bv32 != ~status~1; {12033#(= ~DC~0 ~s~0)} is VALID [2018-11-23 10:48:57,836 INFO L273 TraceCheckUtils]: 40: Hoare triple {12033#(= ~DC~0 ~s~0)} assume !(~s~0 != ~SKIP2~0); {12033#(= ~DC~0 ~s~0)} is VALID [2018-11-23 10:48:57,836 INFO L273 TraceCheckUtils]: 41: Hoare triple {12033#(= ~DC~0 ~s~0)} assume !(1bv32 == ~pended~0); {12033#(= ~DC~0 ~s~0)} is VALID [2018-11-23 10:48:57,837 INFO L273 TraceCheckUtils]: 42: Hoare triple {12033#(= ~DC~0 ~s~0)} assume !(~s~0 == ~DC~0); {11942#false} is VALID [2018-11-23 10:48:57,837 INFO L273 TraceCheckUtils]: 43: Hoare triple {11942#false} assume ~status~1 != ~lowerDriverReturn~0; {11942#false} is VALID [2018-11-23 10:48:57,837 INFO L256 TraceCheckUtils]: 44: Hoare triple {11942#false} call errorFn(); {11942#false} is VALID [2018-11-23 10:48:57,837 INFO L273 TraceCheckUtils]: 45: Hoare triple {11942#false} assume !false; {11942#false} is VALID [2018-11-23 10:48:57,840 INFO L134 CoverageAnalysis]: Checked inductivity of 0 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 0 trivial. 0 not checked. [2018-11-23 10:48:57,840 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-23 10:48:57,841 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 10:48:57,842 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-23 10:48:57,842 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 46 [2018-11-23 10:48:57,842 INFO L84 Accepts]: Finished accepts. word is accepted. [2018-11-23 10:48:57,842 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 3 states. [2018-11-23 10:48:57,896 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 46 edges. 46 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:48:57,896 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-23 10:48:57,897 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-23 10:48:57,897 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 10:48:57,897 INFO L87 Difference]: Start difference. First operand 274 states and 370 transitions. Second operand 3 states. [2018-11-23 10:48:59,624 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:48:59,625 INFO L93 Difference]: Finished difference Result 294 states and 391 transitions. [2018-11-23 10:48:59,625 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-23 10:48:59,625 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 46 [2018-11-23 10:48:59,625 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 10:48:59,625 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 3 states. [2018-11-23 10:48:59,630 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 3 states to 3 states and 314 transitions. [2018-11-23 10:48:59,630 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 3 states. [2018-11-23 10:48:59,634 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 3 states to 3 states and 314 transitions. [2018-11-23 10:48:59,634 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 3 states and 314 transitions. [2018-11-23 10:49:00,020 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 314 edges. 314 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:49:00,025 INFO L225 Difference]: With dead ends: 294 [2018-11-23 10:49:00,025 INFO L226 Difference]: Without dead ends: 244 [2018-11-23 10:49:00,026 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 45 GetRequests, 44 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 10:49:00,026 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 244 states. [2018-11-23 10:49:00,206 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 244 to 244. [2018-11-23 10:49:00,207 INFO L214 AbstractMinimizeNwa]: Start testing correctness of minimizeSevpa [2018-11-23 10:49:00,207 INFO L82 GeneralOperation]: Start isEquivalent. First operand 244 states. Second operand 244 states. [2018-11-23 10:49:00,207 INFO L74 IsIncluded]: Start isIncluded. First operand 244 states. Second operand 244 states. [2018-11-23 10:49:00,207 INFO L87 Difference]: Start difference. First operand 244 states. Second operand 244 states. [2018-11-23 10:49:00,215 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:49:00,215 INFO L93 Difference]: Finished difference Result 244 states and 322 transitions. [2018-11-23 10:49:00,216 INFO L276 IsEmpty]: Start isEmpty. Operand 244 states and 322 transitions. [2018-11-23 10:49:00,216 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:49:00,216 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:49:00,217 INFO L74 IsIncluded]: Start isIncluded. First operand 244 states. Second operand 244 states. [2018-11-23 10:49:00,217 INFO L87 Difference]: Start difference. First operand 244 states. Second operand 244 states. [2018-11-23 10:49:00,223 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:49:00,223 INFO L93 Difference]: Finished difference Result 244 states and 322 transitions. [2018-11-23 10:49:00,223 INFO L276 IsEmpty]: Start isEmpty. Operand 244 states and 322 transitions. [2018-11-23 10:49:00,224 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:49:00,224 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:49:00,224 INFO L88 GeneralOperation]: Finished isEquivalent. [2018-11-23 10:49:00,225 INFO L221 AbstractMinimizeNwa]: Finished testing correctness of minimizeSevpa [2018-11-23 10:49:00,225 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 244 states. [2018-11-23 10:49:00,231 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 244 states to 244 states and 322 transitions. [2018-11-23 10:49:00,231 INFO L78 Accepts]: Start accepts. Automaton has 244 states and 322 transitions. Word has length 46 [2018-11-23 10:49:00,231 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 10:49:00,232 INFO L480 AbstractCegarLoop]: Abstraction has 244 states and 322 transitions. [2018-11-23 10:49:00,232 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-23 10:49:00,232 INFO L276 IsEmpty]: Start isEmpty. Operand 244 states and 322 transitions. [2018-11-23 10:49:00,233 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 54 [2018-11-23 10:49:00,233 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 10:49:00,233 INFO L402 BasicCegarLoop]: trace histogram [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 10:49:00,233 INFO L423 AbstractCegarLoop]: === Iteration 9 === [errorFnErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 10:49:00,233 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 10:49:00,234 INFO L82 PathProgramCache]: Analyzing trace with hash 1852297644, now seen corresponding path program 1 times [2018-11-23 10:49:00,234 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 10:49:00,234 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/cvc4nyu Starting monitored process 10 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 10 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 10:49:00,264 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 10:49:00,346 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:49:00,382 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:49:00,384 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 10:49:00,513 INFO L256 TraceCheckUtils]: 0: Hoare triple {13291#true} call ULTIMATE.init(); {13291#true} is VALID [2018-11-23 10:49:00,513 INFO L273 TraceCheckUtils]: 1: Hoare triple {13291#true} ~KernelMode~0 := 0bv32;~Executive~0 := 0bv32;~DevicePowerState~0 := 0bv32;~s~0 := 0bv32;~UNLOADED~0 := 0bv32;~NP~0 := 0bv32;~DC~0 := 0bv32;~SKIP1~0 := 0bv32;~SKIP2~0 := 0bv32;~MPR1~0 := 0bv32;~MPR3~0 := 0bv32;~IPC~0 := 0bv32;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32;~myStatus~0 := 0bv32; {13291#true} is VALID [2018-11-23 10:49:00,514 INFO L273 TraceCheckUtils]: 2: Hoare triple {13291#true} assume true; {13291#true} is VALID [2018-11-23 10:49:00,514 INFO L268 TraceCheckUtils]: 3: Hoare quadruple {13291#true} {13291#true} #759#return; {13291#true} is VALID [2018-11-23 10:49:00,514 INFO L256 TraceCheckUtils]: 4: Hoare triple {13291#true} call #t~ret77 := main(); {13291#true} is VALID [2018-11-23 10:49:00,514 INFO L273 TraceCheckUtils]: 5: Hoare triple {13291#true} havoc ~status~1;~irp~0 := #t~nondet17;havoc #t~nondet17;havoc ~pirp~0;havoc ~pirp__IoStatus__Status~0;~irp_choice~0 := #t~nondet18;havoc #t~nondet18;~devobj~0 := #t~nondet19;havoc #t~nondet19;havoc ~__cil_tmp8~0;~KernelMode~0 := 0bv32;~Executive~0 := 0bv32;~DevicePowerState~0 := 1bv32;~s~0 := 0bv32;~UNLOADED~0 := 0bv32;~NP~0 := 0bv32;~DC~0 := 0bv32;~SKIP1~0 := 0bv32;~SKIP2~0 := 0bv32;~MPR1~0 := 0bv32;~MPR3~0 := 0bv32;~IPC~0 := 0bv32;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32;~myStatus~0 := 0bv32;~status~1 := 0bv32;~pirp~0 := ~irp~0; {13291#true} is VALID [2018-11-23 10:49:00,515 INFO L256 TraceCheckUtils]: 6: Hoare triple {13291#true} call _BLAST_init(); {13291#true} is VALID [2018-11-23 10:49:00,515 INFO L273 TraceCheckUtils]: 7: Hoare triple {13291#true} ~UNLOADED~0 := 0bv32;~NP~0 := 1bv32;~DC~0 := 2bv32;~SKIP1~0 := 3bv32;~SKIP2~0 := 4bv32;~MPR1~0 := 5bv32;~MPR3~0 := 6bv32;~IPC~0 := 7bv32;~s~0 := ~UNLOADED~0;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32; {13291#true} is VALID [2018-11-23 10:49:00,515 INFO L273 TraceCheckUtils]: 8: Hoare triple {13291#true} assume true; {13291#true} is VALID [2018-11-23 10:49:00,515 INFO L268 TraceCheckUtils]: 9: Hoare quadruple {13291#true} {13291#true} #717#return; {13291#true} is VALID [2018-11-23 10:49:00,515 INFO L273 TraceCheckUtils]: 10: Hoare triple {13291#true} assume ~bvsge32(~status~1, 0bv32);~s~0 := ~NP~0;~customIrp~0 := 0bv32;~setEventCalled~0 := ~customIrp~0;~lowerDriverReturn~0 := ~setEventCalled~0;~compRegistered~0 := ~lowerDriverReturn~0;~pended~0 := ~compRegistered~0;~pirp__IoStatus__Status~0 := 0bv32;~myStatus~0 := 0bv32; {13291#true} is VALID [2018-11-23 10:49:00,516 INFO L273 TraceCheckUtils]: 11: Hoare triple {13291#true} assume !(0bv32 == ~irp_choice~0); {13291#true} is VALID [2018-11-23 10:49:00,516 INFO L256 TraceCheckUtils]: 12: Hoare triple {13291#true} call stub_driver_init(); {13291#true} is VALID [2018-11-23 10:49:00,516 INFO L273 TraceCheckUtils]: 13: Hoare triple {13291#true} ~s~0 := ~NP~0;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32; {13291#true} is VALID [2018-11-23 10:49:00,516 INFO L273 TraceCheckUtils]: 14: Hoare triple {13291#true} assume true; {13291#true} is VALID [2018-11-23 10:49:00,516 INFO L268 TraceCheckUtils]: 15: Hoare quadruple {13291#true} {13291#true} #719#return; {13291#true} is VALID [2018-11-23 10:49:00,516 INFO L273 TraceCheckUtils]: 16: Hoare triple {13291#true} assume !~bvslt32(~status~1, 0bv32);havoc ~tmp_ndt_1~0;~tmp_ndt_1~0 := #t~nondet20;havoc #t~nondet20; {13291#true} is VALID [2018-11-23 10:49:00,517 INFO L273 TraceCheckUtils]: 17: Hoare triple {13291#true} assume !(0bv32 == ~tmp_ndt_1~0);havoc ~tmp_ndt_2~0;~tmp_ndt_2~0 := #t~nondet21;havoc #t~nondet21; {13291#true} is VALID [2018-11-23 10:49:00,517 INFO L273 TraceCheckUtils]: 18: Hoare triple {13291#true} assume !(1bv32 == ~tmp_ndt_2~0);havoc ~tmp_ndt_3~0;~tmp_ndt_3~0 := #t~nondet22;havoc #t~nondet22; {13291#true} is VALID [2018-11-23 10:49:00,517 INFO L273 TraceCheckUtils]: 19: Hoare triple {13291#true} assume 3bv32 == ~tmp_ndt_3~0; {13291#true} is VALID [2018-11-23 10:49:00,517 INFO L256 TraceCheckUtils]: 20: Hoare triple {13291#true} call #t~ret27 := KbFilter_PnP(~devobj~0, ~pirp~0); {13291#true} is VALID [2018-11-23 10:49:00,517 INFO L273 TraceCheckUtils]: 21: Hoare triple {13291#true} ~DeviceObject := #in~DeviceObject;~Irp := #in~Irp;havoc ~devExt~0;havoc ~irpStack~0;havoc ~status~0;~event~0 := #t~nondet0;havoc #t~nondet0;~DeviceObject__DeviceExtension~0 := #t~nondet1;havoc #t~nondet1;~Irp__Tail__Overlay__CurrentStackLocation~0 := #t~nondet2;havoc #t~nondet2;~irpStack__MinorFunction~0 := #t~nondet3;havoc #t~nondet3;~devExt__TopOfStack~0 := #t~nondet4;havoc #t~nondet4;havoc ~devExt__Started~0;havoc ~devExt__Removed~0;havoc ~devExt__SurpriseRemoved~0;havoc ~Irp__IoStatus__Status~0;havoc ~Irp__IoStatus__Information~0;~Irp__CurrentLocation~0 := #t~nondet5;havoc #t~nondet5;havoc ~irpSp~0;havoc ~nextIrpSp~0;havoc ~nextIrpSp__Control~0;havoc ~irpSp___0~0;havoc ~irpSp__Context~0;havoc ~irpSp__Control~0;havoc ~__cil_tmp23~0;~status~0 := 0bv32;~devExt~0 := ~DeviceObject__DeviceExtension~0;~irpStack~0 := ~Irp__Tail__Overlay__CurrentStackLocation~0; {13291#true} is VALID [2018-11-23 10:49:00,517 INFO L273 TraceCheckUtils]: 22: Hoare triple {13291#true} assume 0bv32 == ~irpStack__MinorFunction~0; {13291#true} is VALID [2018-11-23 10:49:00,517 INFO L273 TraceCheckUtils]: 23: Hoare triple {13291#true} ~irpSp~0 := ~Irp__Tail__Overlay__CurrentStackLocation~0;~nextIrpSp~0 := ~bvsub32(~Irp__Tail__Overlay__CurrentStackLocation~0, 1bv32);~nextIrpSp__Control~0 := 0bv32; {13291#true} is VALID [2018-11-23 10:49:00,518 INFO L273 TraceCheckUtils]: 24: Hoare triple {13291#true} assume !(~s~0 != ~NP~0); {13291#true} is VALID [2018-11-23 10:49:00,518 INFO L273 TraceCheckUtils]: 25: Hoare triple {13291#true} assume !(0bv32 != ~compRegistered~0);~compRegistered~0 := 1bv32; {13291#true} is VALID [2018-11-23 10:49:00,518 INFO L273 TraceCheckUtils]: 26: Hoare triple {13291#true} ~irpSp___0~0 := ~bvsub32(~Irp__Tail__Overlay__CurrentStackLocation~0, 1bv32);~irpSp__Context~0 := ~event~0;~irpSp__Control~0 := 224bv32; {13291#true} is VALID [2018-11-23 10:49:00,518 INFO L256 TraceCheckUtils]: 27: Hoare triple {13291#true} call #t~ret6 := IofCallDriver(~devExt__TopOfStack~0, ~Irp); {13291#true} is VALID [2018-11-23 10:49:00,518 INFO L273 TraceCheckUtils]: 28: Hoare triple {13291#true} ~DeviceObject := #in~DeviceObject;~Irp := #in~Irp;havoc ~returnVal2~0;havoc ~compRetStatus~0;~lcontext~0 := #t~nondet30;havoc #t~nondet30;havoc ~__cil_tmp7~0; {13291#true} is VALID [2018-11-23 10:49:00,518 INFO L273 TraceCheckUtils]: 29: Hoare triple {13291#true} assume 0bv32 != ~compRegistered~0; {13291#true} is VALID [2018-11-23 10:49:00,519 INFO L256 TraceCheckUtils]: 30: Hoare triple {13291#true} call #t~ret31 := KbFilter_Complete(~DeviceObject, ~Irp, ~lcontext~0); {13291#true} is VALID [2018-11-23 10:49:00,519 INFO L273 TraceCheckUtils]: 31: Hoare triple {13291#true} ~DeviceObject := #in~DeviceObject;~Irp := #in~Irp;~Context := #in~Context;havoc ~event~1;~event~1 := ~Context; {13291#true} is VALID [2018-11-23 10:49:00,519 INFO L256 TraceCheckUtils]: 32: Hoare triple {13291#true} call #t~ret36 := KeSetEvent(~event~1, 0bv32, 0bv32); {13291#true} is VALID [2018-11-23 10:49:00,519 INFO L273 TraceCheckUtils]: 33: Hoare triple {13291#true} ~Event := #in~Event;~Increment := #in~Increment;~Wait := #in~Wait;~l~0 := #t~nondet34;havoc #t~nondet34;~setEventCalled~0 := 1bv32;#res := ~l~0; {13291#true} is VALID [2018-11-23 10:49:00,519 INFO L273 TraceCheckUtils]: 34: Hoare triple {13291#true} assume true; {13291#true} is VALID [2018-11-23 10:49:00,519 INFO L268 TraceCheckUtils]: 35: Hoare quadruple {13291#true} {13291#true} #711#return; {13291#true} is VALID [2018-11-23 10:49:00,520 INFO L273 TraceCheckUtils]: 36: Hoare triple {13291#true} havoc #t~ret36;#res := 3221225494bv32; {13291#true} is VALID [2018-11-23 10:49:00,520 INFO L273 TraceCheckUtils]: 37: Hoare triple {13291#true} assume true; {13291#true} is VALID [2018-11-23 10:49:00,520 INFO L268 TraceCheckUtils]: 38: Hoare quadruple {13291#true} {13291#true} #735#return; {13291#true} is VALID [2018-11-23 10:49:00,520 INFO L273 TraceCheckUtils]: 39: Hoare triple {13291#true} ~compRetStatus~0 := #t~ret31;havoc #t~ret31;~__cil_tmp7~0 := ~sign_extendFrom32To64(~compRetStatus~0); {13291#true} is VALID [2018-11-23 10:49:00,521 INFO L273 TraceCheckUtils]: 40: Hoare triple {13291#true} assume ~__cil_tmp7~0 == ~sign_extendFrom32To64(3221225494bv32); {13291#true} is VALID [2018-11-23 10:49:00,521 INFO L256 TraceCheckUtils]: 41: Hoare triple {13291#true} call stubMoreProcessingRequired(); {13291#true} is VALID [2018-11-23 10:49:00,529 INFO L273 TraceCheckUtils]: 42: Hoare triple {13291#true} assume ~s~0 == ~NP~0;~s~0 := ~MPR1~0; {13422#(= ~MPR1~0 ~s~0)} is VALID [2018-11-23 10:49:00,529 INFO L273 TraceCheckUtils]: 43: Hoare triple {13422#(= ~MPR1~0 ~s~0)} assume true; {13422#(= ~MPR1~0 ~s~0)} is VALID [2018-11-23 10:49:00,535 INFO L268 TraceCheckUtils]: 44: Hoare quadruple {13422#(= ~MPR1~0 ~s~0)} {13291#true} #737#return; {13422#(= ~MPR1~0 ~s~0)} is VALID [2018-11-23 10:49:00,536 INFO L273 TraceCheckUtils]: 45: Hoare triple {13422#(= ~MPR1~0 ~s~0)} havoc ~tmp_ndt_6~0;~tmp_ndt_6~0 := #t~nondet32;havoc #t~nondet32; {13422#(= ~MPR1~0 ~s~0)} is VALID [2018-11-23 10:49:00,536 INFO L273 TraceCheckUtils]: 46: Hoare triple {13422#(= ~MPR1~0 ~s~0)} assume 0bv32 == ~tmp_ndt_6~0; {13422#(= ~MPR1~0 ~s~0)} is VALID [2018-11-23 10:49:00,537 INFO L273 TraceCheckUtils]: 47: Hoare triple {13422#(= ~MPR1~0 ~s~0)} ~returnVal2~0 := 0bv32; {13422#(= ~MPR1~0 ~s~0)} is VALID [2018-11-23 10:49:00,537 INFO L273 TraceCheckUtils]: 48: Hoare triple {13422#(= ~MPR1~0 ~s~0)} assume !(~s~0 == ~NP~0); {13422#(= ~MPR1~0 ~s~0)} is VALID [2018-11-23 10:49:00,537 INFO L273 TraceCheckUtils]: 49: Hoare triple {13422#(= ~MPR1~0 ~s~0)} assume !(~s~0 == ~MPR1~0); {13292#false} is VALID [2018-11-23 10:49:00,537 INFO L273 TraceCheckUtils]: 50: Hoare triple {13292#false} assume !(~s~0 == ~SKIP1~0); {13292#false} is VALID [2018-11-23 10:49:00,538 INFO L256 TraceCheckUtils]: 51: Hoare triple {13292#false} call errorFn(); {13292#false} is VALID [2018-11-23 10:49:00,538 INFO L273 TraceCheckUtils]: 52: Hoare triple {13292#false} assume !false; {13292#false} is VALID [2018-11-23 10:49:00,539 INFO L134 CoverageAnalysis]: Checked inductivity of 0 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 0 trivial. 0 not checked. [2018-11-23 10:49:00,539 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-23 10:49:00,541 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 10:49:00,542 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-23 10:49:00,542 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 53 [2018-11-23 10:49:00,542 INFO L84 Accepts]: Finished accepts. word is accepted. [2018-11-23 10:49:00,542 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 3 states. [2018-11-23 10:49:00,597 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 53 edges. 53 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:49:00,597 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-23 10:49:00,598 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-23 10:49:00,598 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 10:49:00,598 INFO L87 Difference]: Start difference. First operand 244 states and 322 transitions. Second operand 3 states. [2018-11-23 10:49:02,228 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:49:02,228 INFO L93 Difference]: Finished difference Result 274 states and 357 transitions. [2018-11-23 10:49:02,228 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-23 10:49:02,229 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 53 [2018-11-23 10:49:02,229 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 10:49:02,229 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 3 states. [2018-11-23 10:49:02,232 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 3 states to 3 states and 328 transitions. [2018-11-23 10:49:02,232 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 3 states. [2018-11-23 10:49:02,234 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 3 states to 3 states and 328 transitions. [2018-11-23 10:49:02,234 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 3 states and 328 transitions. [2018-11-23 10:49:02,566 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 328 edges. 328 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:49:02,572 INFO L225 Difference]: With dead ends: 274 [2018-11-23 10:49:02,572 INFO L226 Difference]: Without dead ends: 242 [2018-11-23 10:49:02,572 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 52 GetRequests, 51 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 10:49:02,573 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 242 states. [2018-11-23 10:49:02,816 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 242 to 242. [2018-11-23 10:49:02,816 INFO L214 AbstractMinimizeNwa]: Start testing correctness of minimizeSevpa [2018-11-23 10:49:02,816 INFO L82 GeneralOperation]: Start isEquivalent. First operand 242 states. Second operand 242 states. [2018-11-23 10:49:02,816 INFO L74 IsIncluded]: Start isIncluded. First operand 242 states. Second operand 242 states. [2018-11-23 10:49:02,816 INFO L87 Difference]: Start difference. First operand 242 states. Second operand 242 states. [2018-11-23 10:49:02,822 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:49:02,822 INFO L93 Difference]: Finished difference Result 242 states and 318 transitions. [2018-11-23 10:49:02,822 INFO L276 IsEmpty]: Start isEmpty. Operand 242 states and 318 transitions. [2018-11-23 10:49:02,823 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:49:02,823 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:49:02,824 INFO L74 IsIncluded]: Start isIncluded. First operand 242 states. Second operand 242 states. [2018-11-23 10:49:02,824 INFO L87 Difference]: Start difference. First operand 242 states. Second operand 242 states. [2018-11-23 10:49:02,830 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:49:02,830 INFO L93 Difference]: Finished difference Result 242 states and 318 transitions. [2018-11-23 10:49:02,830 INFO L276 IsEmpty]: Start isEmpty. Operand 242 states and 318 transitions. [2018-11-23 10:49:02,831 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:49:02,831 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:49:02,832 INFO L88 GeneralOperation]: Finished isEquivalent. [2018-11-23 10:49:02,832 INFO L221 AbstractMinimizeNwa]: Finished testing correctness of minimizeSevpa [2018-11-23 10:49:02,832 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 242 states. [2018-11-23 10:49:02,838 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 242 states to 242 states and 318 transitions. [2018-11-23 10:49:02,839 INFO L78 Accepts]: Start accepts. Automaton has 242 states and 318 transitions. Word has length 53 [2018-11-23 10:49:02,839 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 10:49:02,839 INFO L480 AbstractCegarLoop]: Abstraction has 242 states and 318 transitions. [2018-11-23 10:49:02,839 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-23 10:49:02,839 INFO L276 IsEmpty]: Start isEmpty. Operand 242 states and 318 transitions. [2018-11-23 10:49:02,840 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 52 [2018-11-23 10:49:02,840 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 10:49:02,840 INFO L402 BasicCegarLoop]: trace histogram [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 10:49:02,841 INFO L423 AbstractCegarLoop]: === Iteration 10 === [errorFnErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 10:49:02,841 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 10:49:02,841 INFO L82 PathProgramCache]: Analyzing trace with hash 1745163498, now seen corresponding path program 1 times [2018-11-23 10:49:02,841 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 10:49:02,841 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/cvc4nyu Starting monitored process 11 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 11 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 10:49:02,871 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 10:49:02,948 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:49:02,981 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:49:02,982 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 10:49:03,161 INFO L256 TraceCheckUtils]: 0: Hoare triple {14630#true} call ULTIMATE.init(); {14630#true} is VALID [2018-11-23 10:49:03,162 INFO L273 TraceCheckUtils]: 1: Hoare triple {14630#true} ~KernelMode~0 := 0bv32;~Executive~0 := 0bv32;~DevicePowerState~0 := 0bv32;~s~0 := 0bv32;~UNLOADED~0 := 0bv32;~NP~0 := 0bv32;~DC~0 := 0bv32;~SKIP1~0 := 0bv32;~SKIP2~0 := 0bv32;~MPR1~0 := 0bv32;~MPR3~0 := 0bv32;~IPC~0 := 0bv32;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32;~myStatus~0 := 0bv32; {14630#true} is VALID [2018-11-23 10:49:03,162 INFO L273 TraceCheckUtils]: 2: Hoare triple {14630#true} assume true; {14630#true} is VALID [2018-11-23 10:49:03,162 INFO L268 TraceCheckUtils]: 3: Hoare quadruple {14630#true} {14630#true} #759#return; {14630#true} is VALID [2018-11-23 10:49:03,162 INFO L256 TraceCheckUtils]: 4: Hoare triple {14630#true} call #t~ret77 := main(); {14630#true} is VALID [2018-11-23 10:49:03,163 INFO L273 TraceCheckUtils]: 5: Hoare triple {14630#true} havoc ~status~1;~irp~0 := #t~nondet17;havoc #t~nondet17;havoc ~pirp~0;havoc ~pirp__IoStatus__Status~0;~irp_choice~0 := #t~nondet18;havoc #t~nondet18;~devobj~0 := #t~nondet19;havoc #t~nondet19;havoc ~__cil_tmp8~0;~KernelMode~0 := 0bv32;~Executive~0 := 0bv32;~DevicePowerState~0 := 1bv32;~s~0 := 0bv32;~UNLOADED~0 := 0bv32;~NP~0 := 0bv32;~DC~0 := 0bv32;~SKIP1~0 := 0bv32;~SKIP2~0 := 0bv32;~MPR1~0 := 0bv32;~MPR3~0 := 0bv32;~IPC~0 := 0bv32;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32;~myStatus~0 := 0bv32;~status~1 := 0bv32;~pirp~0 := ~irp~0; {14630#true} is VALID [2018-11-23 10:49:03,163 INFO L256 TraceCheckUtils]: 6: Hoare triple {14630#true} call _BLAST_init(); {14630#true} is VALID [2018-11-23 10:49:03,166 INFO L273 TraceCheckUtils]: 7: Hoare triple {14630#true} ~UNLOADED~0 := 0bv32;~NP~0 := 1bv32;~DC~0 := 2bv32;~SKIP1~0 := 3bv32;~SKIP2~0 := 4bv32;~MPR1~0 := 5bv32;~MPR3~0 := 6bv32;~IPC~0 := 7bv32;~s~0 := ~UNLOADED~0;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32; {14656#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} is VALID [2018-11-23 10:49:03,166 INFO L273 TraceCheckUtils]: 8: Hoare triple {14656#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} assume true; {14656#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} is VALID [2018-11-23 10:49:03,167 INFO L268 TraceCheckUtils]: 9: Hoare quadruple {14656#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} {14630#true} #717#return; {14656#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} is VALID [2018-11-23 10:49:03,167 INFO L273 TraceCheckUtils]: 10: Hoare triple {14656#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} assume ~bvsge32(~status~1, 0bv32);~s~0 := ~NP~0;~customIrp~0 := 0bv32;~setEventCalled~0 := ~customIrp~0;~lowerDriverReturn~0 := ~setEventCalled~0;~compRegistered~0 := ~lowerDriverReturn~0;~pended~0 := ~compRegistered~0;~pirp__IoStatus__Status~0 := 0bv32;~myStatus~0 := 0bv32; {14656#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} is VALID [2018-11-23 10:49:03,169 INFO L273 TraceCheckUtils]: 11: Hoare triple {14656#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} assume !(0bv32 == ~irp_choice~0); {14656#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} is VALID [2018-11-23 10:49:03,169 INFO L256 TraceCheckUtils]: 12: Hoare triple {14656#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} call stub_driver_init(); {14656#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} is VALID [2018-11-23 10:49:03,170 INFO L273 TraceCheckUtils]: 13: Hoare triple {14656#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} ~s~0 := ~NP~0;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32; {14656#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} is VALID [2018-11-23 10:49:03,171 INFO L273 TraceCheckUtils]: 14: Hoare triple {14656#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} assume true; {14656#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} is VALID [2018-11-23 10:49:03,171 INFO L268 TraceCheckUtils]: 15: Hoare quadruple {14656#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} {14656#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} #719#return; {14656#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} is VALID [2018-11-23 10:49:03,172 INFO L273 TraceCheckUtils]: 16: Hoare triple {14656#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} assume !~bvslt32(~status~1, 0bv32);havoc ~tmp_ndt_1~0;~tmp_ndt_1~0 := #t~nondet20;havoc #t~nondet20; {14656#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} is VALID [2018-11-23 10:49:03,173 INFO L273 TraceCheckUtils]: 17: Hoare triple {14656#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} assume !(0bv32 == ~tmp_ndt_1~0);havoc ~tmp_ndt_2~0;~tmp_ndt_2~0 := #t~nondet21;havoc #t~nondet21; {14656#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} is VALID [2018-11-23 10:49:03,174 INFO L273 TraceCheckUtils]: 18: Hoare triple {14656#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} assume !(1bv32 == ~tmp_ndt_2~0);havoc ~tmp_ndt_3~0;~tmp_ndt_3~0 := #t~nondet22;havoc #t~nondet22; {14656#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} is VALID [2018-11-23 10:49:03,174 INFO L273 TraceCheckUtils]: 19: Hoare triple {14656#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} assume !(3bv32 == ~tmp_ndt_3~0);havoc ~tmp_ndt_4~0;~tmp_ndt_4~0 := #t~nondet23;havoc #t~nondet23; {14656#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} is VALID [2018-11-23 10:49:03,175 INFO L273 TraceCheckUtils]: 20: Hoare triple {14656#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} assume 4bv32 == ~tmp_ndt_4~0; {14656#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} is VALID [2018-11-23 10:49:03,176 INFO L256 TraceCheckUtils]: 21: Hoare triple {14656#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} call #t~ret28 := KbFilter_Power(~devobj~0, ~pirp~0); {14656#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} is VALID [2018-11-23 10:49:03,177 INFO L273 TraceCheckUtils]: 22: Hoare triple {14656#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} ~DeviceObject := #in~DeviceObject;~Irp := #in~Irp;~irpStack__MinorFunction~1 := #t~nondet46;havoc #t~nondet46;havoc ~devExt__DeviceState~0;~powerState__DeviceState~0 := #t~nondet47;havoc #t~nondet47;~Irp__CurrentLocation~2 := #t~nondet48;havoc #t~nondet48;~Irp__Tail__Overlay__CurrentStackLocation~2 := #t~nondet49;havoc #t~nondet49;~devExt__TopOfStack~1 := #t~nondet50;havoc #t~nondet50;~powerType~0 := #t~nondet51;havoc #t~nondet51;havoc ~tmp~2; {14656#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} is VALID [2018-11-23 10:49:03,178 INFO L273 TraceCheckUtils]: 23: Hoare triple {14656#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} assume 2bv32 == ~irpStack__MinorFunction~1; {14656#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} is VALID [2018-11-23 10:49:03,178 INFO L273 TraceCheckUtils]: 24: Hoare triple {14656#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} assume !(~powerType~0 == ~DevicePowerState~0); {14656#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} is VALID [2018-11-23 10:49:03,179 INFO L273 TraceCheckUtils]: 25: Hoare triple {14656#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} assume ~s~0 == ~NP~0;~s~0 := ~SKIP1~0; {14711#(and (= ~SKIP1~0 ~s~0) (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} is VALID [2018-11-23 10:49:03,181 INFO L273 TraceCheckUtils]: 26: Hoare triple {14711#(and (= ~SKIP1~0 ~s~0) (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} #t~post52 := ~Irp__CurrentLocation~2;~Irp__CurrentLocation~2 := ~bvadd32(1bv32, #t~post52);havoc #t~post52;#t~post53 := ~Irp__Tail__Overlay__CurrentStackLocation~2;~Irp__Tail__Overlay__CurrentStackLocation~2 := ~bvadd32(1bv32, #t~post53);havoc #t~post53; {14711#(and (= ~SKIP1~0 ~s~0) (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} is VALID [2018-11-23 10:49:03,182 INFO L256 TraceCheckUtils]: 27: Hoare triple {14711#(and (= ~SKIP1~0 ~s~0) (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} call #t~ret54 := PoCallDriver(~devExt__TopOfStack~1, ~Irp); {14718#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0) (= |old(~s~0)| ~s~0))} is VALID [2018-11-23 10:49:03,183 INFO L273 TraceCheckUtils]: 28: Hoare triple {14718#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0) (= |old(~s~0)| ~s~0))} ~DeviceObject := #in~DeviceObject;~Irp := #in~Irp;havoc ~compRetStatus~1;havoc ~returnVal~0;~lcontext~1 := #t~nondet55;havoc #t~nondet55;havoc ~__cil_tmp7~1;havoc ~__cil_tmp8~1; {14718#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0) (= |old(~s~0)| ~s~0))} is VALID [2018-11-23 10:49:03,183 INFO L273 TraceCheckUtils]: 29: Hoare triple {14718#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0) (= |old(~s~0)| ~s~0))} assume !(0bv32 != ~compRegistered~0); {14718#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0) (= |old(~s~0)| ~s~0))} is VALID [2018-11-23 10:49:03,184 INFO L273 TraceCheckUtils]: 30: Hoare triple {14718#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0) (= |old(~s~0)| ~s~0))} havoc ~tmp_ndt_9~0;~tmp_ndt_9~0 := #t~nondet57;havoc #t~nondet57; {14718#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0) (= |old(~s~0)| ~s~0))} is VALID [2018-11-23 10:49:03,185 INFO L273 TraceCheckUtils]: 31: Hoare triple {14718#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0) (= |old(~s~0)| ~s~0))} assume 0bv32 == ~tmp_ndt_9~0; {14718#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0) (= |old(~s~0)| ~s~0))} is VALID [2018-11-23 10:49:03,186 INFO L273 TraceCheckUtils]: 32: Hoare triple {14718#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0) (= |old(~s~0)| ~s~0))} ~returnVal~0 := 0bv32; {14718#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0) (= |old(~s~0)| ~s~0))} is VALID [2018-11-23 10:49:03,190 INFO L273 TraceCheckUtils]: 33: Hoare triple {14718#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0) (= |old(~s~0)| ~s~0))} assume ~s~0 == ~NP~0;~s~0 := ~IPC~0;~lowerDriverReturn~0 := ~returnVal~0; {14737#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0) (= |old(~s~0)| ~NP~0))} is VALID [2018-11-23 10:49:03,193 INFO L273 TraceCheckUtils]: 34: Hoare triple {14737#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0) (= |old(~s~0)| ~NP~0))} #res := ~returnVal~0; {14737#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0) (= |old(~s~0)| ~NP~0))} is VALID [2018-11-23 10:49:03,195 INFO L273 TraceCheckUtils]: 35: Hoare triple {14737#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0) (= |old(~s~0)| ~NP~0))} assume true; {14737#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0) (= |old(~s~0)| ~NP~0))} is VALID [2018-11-23 10:49:03,198 INFO L268 TraceCheckUtils]: 36: Hoare quadruple {14737#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0) (= |old(~s~0)| ~NP~0))} {14711#(and (= ~SKIP1~0 ~s~0) (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} #715#return; {14631#false} is VALID [2018-11-23 10:49:03,198 INFO L273 TraceCheckUtils]: 37: Hoare triple {14631#false} ~tmp~2 := #t~ret54;havoc #t~ret54;#res := ~tmp~2; {14631#false} is VALID [2018-11-23 10:49:03,199 INFO L273 TraceCheckUtils]: 38: Hoare triple {14631#false} assume true; {14631#false} is VALID [2018-11-23 10:49:03,199 INFO L268 TraceCheckUtils]: 39: Hoare quadruple {14631#false} {14656#(and (= (bvadd ~SKIP1~0 (_ bv4294967293 32)) (_ bv0 32)) (= (_ bv1 32) ~NP~0))} #727#return; {14631#false} is VALID [2018-11-23 10:49:03,199 INFO L273 TraceCheckUtils]: 40: Hoare triple {14631#false} ~status~1 := #t~ret28;havoc #t~ret28; {14631#false} is VALID [2018-11-23 10:49:03,199 INFO L273 TraceCheckUtils]: 41: Hoare triple {14631#false} assume !(1bv32 == ~pended~0); {14631#false} is VALID [2018-11-23 10:49:03,199 INFO L273 TraceCheckUtils]: 42: Hoare triple {14631#false} assume !(1bv32 == ~pended~0); {14631#false} is VALID [2018-11-23 10:49:03,200 INFO L273 TraceCheckUtils]: 43: Hoare triple {14631#false} assume ~s~0 != ~UNLOADED~0; {14631#false} is VALID [2018-11-23 10:49:03,200 INFO L273 TraceCheckUtils]: 44: Hoare triple {14631#false} assume 4294967295bv32 != ~status~1; {14631#false} is VALID [2018-11-23 10:49:03,200 INFO L273 TraceCheckUtils]: 45: Hoare triple {14631#false} assume !(~s~0 != ~SKIP2~0); {14631#false} is VALID [2018-11-23 10:49:03,200 INFO L273 TraceCheckUtils]: 46: Hoare triple {14631#false} assume !(1bv32 == ~pended~0); {14631#false} is VALID [2018-11-23 10:49:03,200 INFO L273 TraceCheckUtils]: 47: Hoare triple {14631#false} assume !(~s~0 == ~DC~0); {14631#false} is VALID [2018-11-23 10:49:03,201 INFO L273 TraceCheckUtils]: 48: Hoare triple {14631#false} assume ~status~1 != ~lowerDriverReturn~0; {14631#false} is VALID [2018-11-23 10:49:03,201 INFO L256 TraceCheckUtils]: 49: Hoare triple {14631#false} call errorFn(); {14631#false} is VALID [2018-11-23 10:49:03,201 INFO L273 TraceCheckUtils]: 50: Hoare triple {14631#false} assume !false; {14631#false} is VALID [2018-11-23 10:49:03,214 INFO L134 CoverageAnalysis]: Checked inductivity of 0 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 0 trivial. 0 not checked. [2018-11-23 10:49:03,214 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [MP cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (11)] Exception during sending of exit command (exit): Broken pipe [2018-11-23 10:49:03,218 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 10:49:03,218 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [6] imperfect sequences [] total 6 [2018-11-23 10:49:03,218 INFO L78 Accepts]: Start accepts. Automaton has 6 states. Word has length 51 [2018-11-23 10:49:03,219 INFO L84 Accepts]: Finished accepts. word is accepted. [2018-11-23 10:49:03,219 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 6 states. [2018-11-23 10:49:03,292 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 51 edges. 51 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:49:03,292 INFO L459 AbstractCegarLoop]: Interpolant automaton has 6 states [2018-11-23 10:49:03,293 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 6 interpolants. [2018-11-23 10:49:03,293 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=12, Invalid=18, Unknown=0, NotChecked=0, Total=30 [2018-11-23 10:49:03,293 INFO L87 Difference]: Start difference. First operand 242 states and 318 transitions. Second operand 6 states. [2018-11-23 10:49:06,664 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:49:06,664 INFO L93 Difference]: Finished difference Result 286 states and 366 transitions. [2018-11-23 10:49:06,664 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 8 states. [2018-11-23 10:49:06,664 INFO L78 Accepts]: Start accepts. Automaton has 6 states. Word has length 51 [2018-11-23 10:49:06,665 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 10:49:06,665 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 6 states. [2018-11-23 10:49:06,667 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 8 states to 8 states and 364 transitions. [2018-11-23 10:49:06,667 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 6 states. [2018-11-23 10:49:06,670 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 8 states to 8 states and 364 transitions. [2018-11-23 10:49:06,671 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 8 states and 364 transitions. [2018-11-23 10:49:07,180 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 364 edges. 364 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:49:07,186 INFO L225 Difference]: With dead ends: 286 [2018-11-23 10:49:07,186 INFO L226 Difference]: Without dead ends: 245 [2018-11-23 10:49:07,186 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 53 GetRequests, 45 SyntacticMatches, 1 SemanticMatches, 7 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 3 ImplicationChecksByTransitivity, 0.1s TimeCoverageRelationStatistics Valid=27, Invalid=45, Unknown=0, NotChecked=0, Total=72 [2018-11-23 10:49:07,187 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 245 states. [2018-11-23 10:49:08,054 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 245 to 242. [2018-11-23 10:49:08,054 INFO L214 AbstractMinimizeNwa]: Start testing correctness of minimizeSevpa [2018-11-23 10:49:08,054 INFO L82 GeneralOperation]: Start isEquivalent. First operand 245 states. Second operand 242 states. [2018-11-23 10:49:08,055 INFO L74 IsIncluded]: Start isIncluded. First operand 245 states. Second operand 242 states. [2018-11-23 10:49:08,055 INFO L87 Difference]: Start difference. First operand 245 states. Second operand 242 states. [2018-11-23 10:49:08,061 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:49:08,062 INFO L93 Difference]: Finished difference Result 245 states and 318 transitions. [2018-11-23 10:49:08,062 INFO L276 IsEmpty]: Start isEmpty. Operand 245 states and 318 transitions. [2018-11-23 10:49:08,063 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:49:08,063 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:49:08,063 INFO L74 IsIncluded]: Start isIncluded. First operand 242 states. Second operand 245 states. [2018-11-23 10:49:08,063 INFO L87 Difference]: Start difference. First operand 242 states. Second operand 245 states. [2018-11-23 10:49:08,070 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:49:08,070 INFO L93 Difference]: Finished difference Result 245 states and 318 transitions. [2018-11-23 10:49:08,070 INFO L276 IsEmpty]: Start isEmpty. Operand 245 states and 318 transitions. [2018-11-23 10:49:08,071 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:49:08,071 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:49:08,071 INFO L88 GeneralOperation]: Finished isEquivalent. [2018-11-23 10:49:08,071 INFO L221 AbstractMinimizeNwa]: Finished testing correctness of minimizeSevpa [2018-11-23 10:49:08,072 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 242 states. [2018-11-23 10:49:08,078 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 242 states to 242 states and 316 transitions. [2018-11-23 10:49:08,078 INFO L78 Accepts]: Start accepts. Automaton has 242 states and 316 transitions. Word has length 51 [2018-11-23 10:49:08,078 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 10:49:08,079 INFO L480 AbstractCegarLoop]: Abstraction has 242 states and 316 transitions. [2018-11-23 10:49:08,079 INFO L481 AbstractCegarLoop]: Interpolant automaton has 6 states. [2018-11-23 10:49:08,079 INFO L276 IsEmpty]: Start isEmpty. Operand 242 states and 316 transitions. [2018-11-23 10:49:08,080 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 54 [2018-11-23 10:49:08,080 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 10:49:08,080 INFO L402 BasicCegarLoop]: trace histogram [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 10:49:08,081 INFO L423 AbstractCegarLoop]: === Iteration 11 === [errorFnErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 10:49:08,081 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 10:49:08,081 INFO L82 PathProgramCache]: Analyzing trace with hash 240184037, now seen corresponding path program 1 times [2018-11-23 10:49:08,081 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 10:49:08,081 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/cvc4nyu Starting monitored process 12 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 12 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 10:49:08,143 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 10:49:08,219 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:49:08,258 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:49:08,260 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 10:49:08,381 INFO L256 TraceCheckUtils]: 0: Hoare triple {15987#true} call ULTIMATE.init(); {15987#true} is VALID [2018-11-23 10:49:08,382 INFO L273 TraceCheckUtils]: 1: Hoare triple {15987#true} ~KernelMode~0 := 0bv32;~Executive~0 := 0bv32;~DevicePowerState~0 := 0bv32;~s~0 := 0bv32;~UNLOADED~0 := 0bv32;~NP~0 := 0bv32;~DC~0 := 0bv32;~SKIP1~0 := 0bv32;~SKIP2~0 := 0bv32;~MPR1~0 := 0bv32;~MPR3~0 := 0bv32;~IPC~0 := 0bv32;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32;~myStatus~0 := 0bv32; {15987#true} is VALID [2018-11-23 10:49:08,382 INFO L273 TraceCheckUtils]: 2: Hoare triple {15987#true} assume true; {15987#true} is VALID [2018-11-23 10:49:08,382 INFO L268 TraceCheckUtils]: 3: Hoare quadruple {15987#true} {15987#true} #759#return; {15987#true} is VALID [2018-11-23 10:49:08,383 INFO L256 TraceCheckUtils]: 4: Hoare triple {15987#true} call #t~ret77 := main(); {15987#true} is VALID [2018-11-23 10:49:08,383 INFO L273 TraceCheckUtils]: 5: Hoare triple {15987#true} havoc ~status~1;~irp~0 := #t~nondet17;havoc #t~nondet17;havoc ~pirp~0;havoc ~pirp__IoStatus__Status~0;~irp_choice~0 := #t~nondet18;havoc #t~nondet18;~devobj~0 := #t~nondet19;havoc #t~nondet19;havoc ~__cil_tmp8~0;~KernelMode~0 := 0bv32;~Executive~0 := 0bv32;~DevicePowerState~0 := 1bv32;~s~0 := 0bv32;~UNLOADED~0 := 0bv32;~NP~0 := 0bv32;~DC~0 := 0bv32;~SKIP1~0 := 0bv32;~SKIP2~0 := 0bv32;~MPR1~0 := 0bv32;~MPR3~0 := 0bv32;~IPC~0 := 0bv32;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32;~myStatus~0 := 0bv32;~status~1 := 0bv32;~pirp~0 := ~irp~0; {15987#true} is VALID [2018-11-23 10:49:08,383 INFO L256 TraceCheckUtils]: 6: Hoare triple {15987#true} call _BLAST_init(); {15987#true} is VALID [2018-11-23 10:49:08,383 INFO L273 TraceCheckUtils]: 7: Hoare triple {15987#true} ~UNLOADED~0 := 0bv32;~NP~0 := 1bv32;~DC~0 := 2bv32;~SKIP1~0 := 3bv32;~SKIP2~0 := 4bv32;~MPR1~0 := 5bv32;~MPR3~0 := 6bv32;~IPC~0 := 7bv32;~s~0 := ~UNLOADED~0;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32; {15987#true} is VALID [2018-11-23 10:49:08,383 INFO L273 TraceCheckUtils]: 8: Hoare triple {15987#true} assume true; {15987#true} is VALID [2018-11-23 10:49:08,384 INFO L268 TraceCheckUtils]: 9: Hoare quadruple {15987#true} {15987#true} #717#return; {15987#true} is VALID [2018-11-23 10:49:08,384 INFO L273 TraceCheckUtils]: 10: Hoare triple {15987#true} assume ~bvsge32(~status~1, 0bv32);~s~0 := ~NP~0;~customIrp~0 := 0bv32;~setEventCalled~0 := ~customIrp~0;~lowerDriverReturn~0 := ~setEventCalled~0;~compRegistered~0 := ~lowerDriverReturn~0;~pended~0 := ~compRegistered~0;~pirp__IoStatus__Status~0 := 0bv32;~myStatus~0 := 0bv32; {15987#true} is VALID [2018-11-23 10:49:08,384 INFO L273 TraceCheckUtils]: 11: Hoare triple {15987#true} assume !(0bv32 == ~irp_choice~0); {15987#true} is VALID [2018-11-23 10:49:08,384 INFO L256 TraceCheckUtils]: 12: Hoare triple {15987#true} call stub_driver_init(); {15987#true} is VALID [2018-11-23 10:49:08,385 INFO L273 TraceCheckUtils]: 13: Hoare triple {15987#true} ~s~0 := ~NP~0;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32; {15987#true} is VALID [2018-11-23 10:49:08,385 INFO L273 TraceCheckUtils]: 14: Hoare triple {15987#true} assume true; {15987#true} is VALID [2018-11-23 10:49:08,385 INFO L268 TraceCheckUtils]: 15: Hoare quadruple {15987#true} {15987#true} #719#return; {15987#true} is VALID [2018-11-23 10:49:08,385 INFO L273 TraceCheckUtils]: 16: Hoare triple {15987#true} assume !~bvslt32(~status~1, 0bv32);havoc ~tmp_ndt_1~0;~tmp_ndt_1~0 := #t~nondet20;havoc #t~nondet20; {15987#true} is VALID [2018-11-23 10:49:08,385 INFO L273 TraceCheckUtils]: 17: Hoare triple {15987#true} assume !(0bv32 == ~tmp_ndt_1~0);havoc ~tmp_ndt_2~0;~tmp_ndt_2~0 := #t~nondet21;havoc #t~nondet21; {15987#true} is VALID [2018-11-23 10:49:08,385 INFO L273 TraceCheckUtils]: 18: Hoare triple {15987#true} assume !(1bv32 == ~tmp_ndt_2~0);havoc ~tmp_ndt_3~0;~tmp_ndt_3~0 := #t~nondet22;havoc #t~nondet22; {15987#true} is VALID [2018-11-23 10:49:08,386 INFO L273 TraceCheckUtils]: 19: Hoare triple {15987#true} assume !(3bv32 == ~tmp_ndt_3~0);havoc ~tmp_ndt_4~0;~tmp_ndt_4~0 := #t~nondet23;havoc #t~nondet23; {15987#true} is VALID [2018-11-23 10:49:08,386 INFO L273 TraceCheckUtils]: 20: Hoare triple {15987#true} assume 4bv32 == ~tmp_ndt_4~0; {15987#true} is VALID [2018-11-23 10:49:08,386 INFO L256 TraceCheckUtils]: 21: Hoare triple {15987#true} call #t~ret28 := KbFilter_Power(~devobj~0, ~pirp~0); {15987#true} is VALID [2018-11-23 10:49:08,386 INFO L273 TraceCheckUtils]: 22: Hoare triple {15987#true} ~DeviceObject := #in~DeviceObject;~Irp := #in~Irp;~irpStack__MinorFunction~1 := #t~nondet46;havoc #t~nondet46;havoc ~devExt__DeviceState~0;~powerState__DeviceState~0 := #t~nondet47;havoc #t~nondet47;~Irp__CurrentLocation~2 := #t~nondet48;havoc #t~nondet48;~Irp__Tail__Overlay__CurrentStackLocation~2 := #t~nondet49;havoc #t~nondet49;~devExt__TopOfStack~1 := #t~nondet50;havoc #t~nondet50;~powerType~0 := #t~nondet51;havoc #t~nondet51;havoc ~tmp~2; {15987#true} is VALID [2018-11-23 10:49:08,386 INFO L273 TraceCheckUtils]: 23: Hoare triple {15987#true} assume 2bv32 == ~irpStack__MinorFunction~1; {15987#true} is VALID [2018-11-23 10:49:08,386 INFO L273 TraceCheckUtils]: 24: Hoare triple {15987#true} assume !(~powerType~0 == ~DevicePowerState~0); {15987#true} is VALID [2018-11-23 10:49:08,386 INFO L273 TraceCheckUtils]: 25: Hoare triple {15987#true} assume ~s~0 == ~NP~0;~s~0 := ~SKIP1~0; {15987#true} is VALID [2018-11-23 10:49:08,386 INFO L273 TraceCheckUtils]: 26: Hoare triple {15987#true} #t~post52 := ~Irp__CurrentLocation~2;~Irp__CurrentLocation~2 := ~bvadd32(1bv32, #t~post52);havoc #t~post52;#t~post53 := ~Irp__Tail__Overlay__CurrentStackLocation~2;~Irp__Tail__Overlay__CurrentStackLocation~2 := ~bvadd32(1bv32, #t~post53);havoc #t~post53; {15987#true} is VALID [2018-11-23 10:49:08,387 INFO L256 TraceCheckUtils]: 27: Hoare triple {15987#true} call #t~ret54 := PoCallDriver(~devExt__TopOfStack~1, ~Irp); {15987#true} is VALID [2018-11-23 10:49:08,387 INFO L273 TraceCheckUtils]: 28: Hoare triple {15987#true} ~DeviceObject := #in~DeviceObject;~Irp := #in~Irp;havoc ~compRetStatus~1;havoc ~returnVal~0;~lcontext~1 := #t~nondet55;havoc #t~nondet55;havoc ~__cil_tmp7~1;havoc ~__cil_tmp8~1; {15987#true} is VALID [2018-11-23 10:49:08,387 INFO L273 TraceCheckUtils]: 29: Hoare triple {15987#true} assume !(0bv32 != ~compRegistered~0); {15987#true} is VALID [2018-11-23 10:49:08,387 INFO L273 TraceCheckUtils]: 30: Hoare triple {15987#true} havoc ~tmp_ndt_9~0;~tmp_ndt_9~0 := #t~nondet57;havoc #t~nondet57; {15987#true} is VALID [2018-11-23 10:49:08,387 INFO L273 TraceCheckUtils]: 31: Hoare triple {15987#true} assume 0bv32 == ~tmp_ndt_9~0; {15987#true} is VALID [2018-11-23 10:49:08,387 INFO L273 TraceCheckUtils]: 32: Hoare triple {15987#true} ~returnVal~0 := 0bv32; {15987#true} is VALID [2018-11-23 10:49:08,387 INFO L273 TraceCheckUtils]: 33: Hoare triple {15987#true} assume !(~s~0 == ~NP~0); {15987#true} is VALID [2018-11-23 10:49:08,388 INFO L273 TraceCheckUtils]: 34: Hoare triple {15987#true} assume !(~s~0 == ~MPR1~0); {15987#true} is VALID [2018-11-23 10:49:08,393 INFO L273 TraceCheckUtils]: 35: Hoare triple {15987#true} assume ~s~0 == ~SKIP1~0;~s~0 := ~SKIP2~0;~lowerDriverReturn~0 := ~returnVal~0; {16097#(= ~lowerDriverReturn~0 PoCallDriver_~returnVal~0)} is VALID [2018-11-23 10:49:08,394 INFO L273 TraceCheckUtils]: 36: Hoare triple {16097#(= ~lowerDriverReturn~0 PoCallDriver_~returnVal~0)} #res := ~returnVal~0; {16101#(= |PoCallDriver_#res| ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:08,394 INFO L273 TraceCheckUtils]: 37: Hoare triple {16101#(= |PoCallDriver_#res| ~lowerDriverReturn~0)} assume true; {16101#(= |PoCallDriver_#res| ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:08,395 INFO L268 TraceCheckUtils]: 38: Hoare quadruple {16101#(= |PoCallDriver_#res| ~lowerDriverReturn~0)} {15987#true} #715#return; {16108#(= ~lowerDriverReturn~0 |KbFilter_Power_#t~ret54|)} is VALID [2018-11-23 10:49:08,395 INFO L273 TraceCheckUtils]: 39: Hoare triple {16108#(= ~lowerDriverReturn~0 |KbFilter_Power_#t~ret54|)} ~tmp~2 := #t~ret54;havoc #t~ret54;#res := ~tmp~2; {16112#(= |KbFilter_Power_#res| ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:08,395 INFO L273 TraceCheckUtils]: 40: Hoare triple {16112#(= |KbFilter_Power_#res| ~lowerDriverReturn~0)} assume true; {16112#(= |KbFilter_Power_#res| ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:08,396 INFO L268 TraceCheckUtils]: 41: Hoare quadruple {16112#(= |KbFilter_Power_#res| ~lowerDriverReturn~0)} {15987#true} #727#return; {16119#(= |main_#t~ret28| ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:08,397 INFO L273 TraceCheckUtils]: 42: Hoare triple {16119#(= |main_#t~ret28| ~lowerDriverReturn~0)} ~status~1 := #t~ret28;havoc #t~ret28; {16123#(= main_~status~1 ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:08,397 INFO L273 TraceCheckUtils]: 43: Hoare triple {16123#(= main_~status~1 ~lowerDriverReturn~0)} assume !(1bv32 == ~pended~0); {16123#(= main_~status~1 ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:08,398 INFO L273 TraceCheckUtils]: 44: Hoare triple {16123#(= main_~status~1 ~lowerDriverReturn~0)} assume !(1bv32 == ~pended~0); {16123#(= main_~status~1 ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:08,398 INFO L273 TraceCheckUtils]: 45: Hoare triple {16123#(= main_~status~1 ~lowerDriverReturn~0)} assume ~s~0 != ~UNLOADED~0; {16123#(= main_~status~1 ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:08,399 INFO L273 TraceCheckUtils]: 46: Hoare triple {16123#(= main_~status~1 ~lowerDriverReturn~0)} assume 4294967295bv32 != ~status~1; {16123#(= main_~status~1 ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:08,399 INFO L273 TraceCheckUtils]: 47: Hoare triple {16123#(= main_~status~1 ~lowerDriverReturn~0)} assume !(~s~0 != ~SKIP2~0); {16123#(= main_~status~1 ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:08,400 INFO L273 TraceCheckUtils]: 48: Hoare triple {16123#(= main_~status~1 ~lowerDriverReturn~0)} assume !(1bv32 == ~pended~0); {16123#(= main_~status~1 ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:08,401 INFO L273 TraceCheckUtils]: 49: Hoare triple {16123#(= main_~status~1 ~lowerDriverReturn~0)} assume !(~s~0 == ~DC~0); {16123#(= main_~status~1 ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:08,401 INFO L273 TraceCheckUtils]: 50: Hoare triple {16123#(= main_~status~1 ~lowerDriverReturn~0)} assume ~status~1 != ~lowerDriverReturn~0; {15988#false} is VALID [2018-11-23 10:49:08,401 INFO L256 TraceCheckUtils]: 51: Hoare triple {15988#false} call errorFn(); {15988#false} is VALID [2018-11-23 10:49:08,402 INFO L273 TraceCheckUtils]: 52: Hoare triple {15988#false} assume !false; {15988#false} is VALID [2018-11-23 10:49:08,405 INFO L134 CoverageAnalysis]: Checked inductivity of 0 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 0 trivial. 0 not checked. [2018-11-23 10:49:08,405 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-23 10:49:08,410 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 10:49:08,410 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [8] imperfect sequences [] total 8 [2018-11-23 10:49:08,410 INFO L78 Accepts]: Start accepts. Automaton has 8 states. Word has length 53 [2018-11-23 10:49:08,411 INFO L84 Accepts]: Finished accepts. word is accepted. [2018-11-23 10:49:08,411 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 8 states. [2018-11-23 10:49:08,481 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 53 edges. 53 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:49:08,481 INFO L459 AbstractCegarLoop]: Interpolant automaton has 8 states [2018-11-23 10:49:08,481 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 8 interpolants. [2018-11-23 10:49:08,482 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=13, Invalid=43, Unknown=0, NotChecked=0, Total=56 [2018-11-23 10:49:08,482 INFO L87 Difference]: Start difference. First operand 242 states and 316 transitions. Second operand 8 states. [2018-11-23 10:49:12,057 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:49:12,057 INFO L93 Difference]: Finished difference Result 254 states and 328 transitions. [2018-11-23 10:49:12,058 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 8 states. [2018-11-23 10:49:12,058 INFO L78 Accepts]: Start accepts. Automaton has 8 states. Word has length 53 [2018-11-23 10:49:12,058 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 10:49:12,058 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 8 states. [2018-11-23 10:49:12,061 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 8 states to 8 states and 291 transitions. [2018-11-23 10:49:12,061 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 8 states. [2018-11-23 10:49:12,063 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 8 states to 8 states and 291 transitions. [2018-11-23 10:49:12,064 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 8 states and 291 transitions. [2018-11-23 10:49:14,555 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 291 edges. 291 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:49:14,560 INFO L225 Difference]: With dead ends: 254 [2018-11-23 10:49:14,561 INFO L226 Difference]: Without dead ends: 213 [2018-11-23 10:49:14,561 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 53 GetRequests, 46 SyntacticMatches, 0 SemanticMatches, 7 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=17, Invalid=55, Unknown=0, NotChecked=0, Total=72 [2018-11-23 10:49:14,562 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 213 states. [2018-11-23 10:49:15,301 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 213 to 213. [2018-11-23 10:49:15,301 INFO L214 AbstractMinimizeNwa]: Start testing correctness of minimizeSevpa [2018-11-23 10:49:15,301 INFO L82 GeneralOperation]: Start isEquivalent. First operand 213 states. Second operand 213 states. [2018-11-23 10:49:15,302 INFO L74 IsIncluded]: Start isIncluded. First operand 213 states. Second operand 213 states. [2018-11-23 10:49:15,302 INFO L87 Difference]: Start difference. First operand 213 states. Second operand 213 states. [2018-11-23 10:49:15,307 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:49:15,307 INFO L93 Difference]: Finished difference Result 213 states and 277 transitions. [2018-11-23 10:49:15,308 INFO L276 IsEmpty]: Start isEmpty. Operand 213 states and 277 transitions. [2018-11-23 10:49:15,308 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:49:15,309 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:49:15,309 INFO L74 IsIncluded]: Start isIncluded. First operand 213 states. Second operand 213 states. [2018-11-23 10:49:15,309 INFO L87 Difference]: Start difference. First operand 213 states. Second operand 213 states. [2018-11-23 10:49:15,314 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:49:15,315 INFO L93 Difference]: Finished difference Result 213 states and 277 transitions. [2018-11-23 10:49:15,315 INFO L276 IsEmpty]: Start isEmpty. Operand 213 states and 277 transitions. [2018-11-23 10:49:15,316 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:49:15,316 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:49:15,316 INFO L88 GeneralOperation]: Finished isEquivalent. [2018-11-23 10:49:15,316 INFO L221 AbstractMinimizeNwa]: Finished testing correctness of minimizeSevpa [2018-11-23 10:49:15,316 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 213 states. [2018-11-23 10:49:15,321 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 213 states to 213 states and 277 transitions. [2018-11-23 10:49:15,322 INFO L78 Accepts]: Start accepts. Automaton has 213 states and 277 transitions. Word has length 53 [2018-11-23 10:49:15,322 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 10:49:15,322 INFO L480 AbstractCegarLoop]: Abstraction has 213 states and 277 transitions. [2018-11-23 10:49:15,322 INFO L481 AbstractCegarLoop]: Interpolant automaton has 8 states. [2018-11-23 10:49:15,322 INFO L276 IsEmpty]: Start isEmpty. Operand 213 states and 277 transitions. [2018-11-23 10:49:15,323 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 55 [2018-11-23 10:49:15,323 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 10:49:15,323 INFO L402 BasicCegarLoop]: trace histogram [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 10:49:15,324 INFO L423 AbstractCegarLoop]: === Iteration 12 === [errorFnErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 10:49:15,324 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 10:49:15,324 INFO L82 PathProgramCache]: Analyzing trace with hash -1569125, now seen corresponding path program 1 times [2018-11-23 10:49:15,324 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 10:49:15,324 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/cvc4nyu Starting monitored process 13 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 13 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 10:49:15,351 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 10:49:15,440 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:49:15,467 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:49:15,469 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 10:49:15,585 INFO L256 TraceCheckUtils]: 0: Hoare triple {17210#true} call ULTIMATE.init(); {17210#true} is VALID [2018-11-23 10:49:15,585 INFO L273 TraceCheckUtils]: 1: Hoare triple {17210#true} ~KernelMode~0 := 0bv32;~Executive~0 := 0bv32;~DevicePowerState~0 := 0bv32;~s~0 := 0bv32;~UNLOADED~0 := 0bv32;~NP~0 := 0bv32;~DC~0 := 0bv32;~SKIP1~0 := 0bv32;~SKIP2~0 := 0bv32;~MPR1~0 := 0bv32;~MPR3~0 := 0bv32;~IPC~0 := 0bv32;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32;~myStatus~0 := 0bv32; {17210#true} is VALID [2018-11-23 10:49:15,586 INFO L273 TraceCheckUtils]: 2: Hoare triple {17210#true} assume true; {17210#true} is VALID [2018-11-23 10:49:15,586 INFO L268 TraceCheckUtils]: 3: Hoare quadruple {17210#true} {17210#true} #759#return; {17210#true} is VALID [2018-11-23 10:49:15,586 INFO L256 TraceCheckUtils]: 4: Hoare triple {17210#true} call #t~ret77 := main(); {17210#true} is VALID [2018-11-23 10:49:15,586 INFO L273 TraceCheckUtils]: 5: Hoare triple {17210#true} havoc ~status~1;~irp~0 := #t~nondet17;havoc #t~nondet17;havoc ~pirp~0;havoc ~pirp__IoStatus__Status~0;~irp_choice~0 := #t~nondet18;havoc #t~nondet18;~devobj~0 := #t~nondet19;havoc #t~nondet19;havoc ~__cil_tmp8~0;~KernelMode~0 := 0bv32;~Executive~0 := 0bv32;~DevicePowerState~0 := 1bv32;~s~0 := 0bv32;~UNLOADED~0 := 0bv32;~NP~0 := 0bv32;~DC~0 := 0bv32;~SKIP1~0 := 0bv32;~SKIP2~0 := 0bv32;~MPR1~0 := 0bv32;~MPR3~0 := 0bv32;~IPC~0 := 0bv32;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32;~myStatus~0 := 0bv32;~status~1 := 0bv32;~pirp~0 := ~irp~0; {17210#true} is VALID [2018-11-23 10:49:15,587 INFO L256 TraceCheckUtils]: 6: Hoare triple {17210#true} call _BLAST_init(); {17210#true} is VALID [2018-11-23 10:49:15,587 INFO L273 TraceCheckUtils]: 7: Hoare triple {17210#true} ~UNLOADED~0 := 0bv32;~NP~0 := 1bv32;~DC~0 := 2bv32;~SKIP1~0 := 3bv32;~SKIP2~0 := 4bv32;~MPR1~0 := 5bv32;~MPR3~0 := 6bv32;~IPC~0 := 7bv32;~s~0 := ~UNLOADED~0;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32; {17210#true} is VALID [2018-11-23 10:49:15,587 INFO L273 TraceCheckUtils]: 8: Hoare triple {17210#true} assume true; {17210#true} is VALID [2018-11-23 10:49:15,587 INFO L268 TraceCheckUtils]: 9: Hoare quadruple {17210#true} {17210#true} #717#return; {17210#true} is VALID [2018-11-23 10:49:15,588 INFO L273 TraceCheckUtils]: 10: Hoare triple {17210#true} assume ~bvsge32(~status~1, 0bv32);~s~0 := ~NP~0;~customIrp~0 := 0bv32;~setEventCalled~0 := ~customIrp~0;~lowerDriverReturn~0 := ~setEventCalled~0;~compRegistered~0 := ~lowerDriverReturn~0;~pended~0 := ~compRegistered~0;~pirp__IoStatus__Status~0 := 0bv32;~myStatus~0 := 0bv32; {17210#true} is VALID [2018-11-23 10:49:15,588 INFO L273 TraceCheckUtils]: 11: Hoare triple {17210#true} assume !(0bv32 == ~irp_choice~0); {17210#true} is VALID [2018-11-23 10:49:15,588 INFO L256 TraceCheckUtils]: 12: Hoare triple {17210#true} call stub_driver_init(); {17210#true} is VALID [2018-11-23 10:49:15,588 INFO L273 TraceCheckUtils]: 13: Hoare triple {17210#true} ~s~0 := ~NP~0;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32; {17210#true} is VALID [2018-11-23 10:49:15,589 INFO L273 TraceCheckUtils]: 14: Hoare triple {17210#true} assume true; {17210#true} is VALID [2018-11-23 10:49:15,589 INFO L268 TraceCheckUtils]: 15: Hoare quadruple {17210#true} {17210#true} #719#return; {17210#true} is VALID [2018-11-23 10:49:15,589 INFO L273 TraceCheckUtils]: 16: Hoare triple {17210#true} assume !~bvslt32(~status~1, 0bv32);havoc ~tmp_ndt_1~0;~tmp_ndt_1~0 := #t~nondet20;havoc #t~nondet20; {17210#true} is VALID [2018-11-23 10:49:15,589 INFO L273 TraceCheckUtils]: 17: Hoare triple {17210#true} assume !(0bv32 == ~tmp_ndt_1~0);havoc ~tmp_ndt_2~0;~tmp_ndt_2~0 := #t~nondet21;havoc #t~nondet21; {17210#true} is VALID [2018-11-23 10:49:15,589 INFO L273 TraceCheckUtils]: 18: Hoare triple {17210#true} assume !(1bv32 == ~tmp_ndt_2~0);havoc ~tmp_ndt_3~0;~tmp_ndt_3~0 := #t~nondet22;havoc #t~nondet22; {17210#true} is VALID [2018-11-23 10:49:15,589 INFO L273 TraceCheckUtils]: 19: Hoare triple {17210#true} assume 3bv32 == ~tmp_ndt_3~0; {17210#true} is VALID [2018-11-23 10:49:15,589 INFO L256 TraceCheckUtils]: 20: Hoare triple {17210#true} call #t~ret27 := KbFilter_PnP(~devobj~0, ~pirp~0); {17210#true} is VALID [2018-11-23 10:49:15,590 INFO L273 TraceCheckUtils]: 21: Hoare triple {17210#true} ~DeviceObject := #in~DeviceObject;~Irp := #in~Irp;havoc ~devExt~0;havoc ~irpStack~0;havoc ~status~0;~event~0 := #t~nondet0;havoc #t~nondet0;~DeviceObject__DeviceExtension~0 := #t~nondet1;havoc #t~nondet1;~Irp__Tail__Overlay__CurrentStackLocation~0 := #t~nondet2;havoc #t~nondet2;~irpStack__MinorFunction~0 := #t~nondet3;havoc #t~nondet3;~devExt__TopOfStack~0 := #t~nondet4;havoc #t~nondet4;havoc ~devExt__Started~0;havoc ~devExt__Removed~0;havoc ~devExt__SurpriseRemoved~0;havoc ~Irp__IoStatus__Status~0;havoc ~Irp__IoStatus__Information~0;~Irp__CurrentLocation~0 := #t~nondet5;havoc #t~nondet5;havoc ~irpSp~0;havoc ~nextIrpSp~0;havoc ~nextIrpSp__Control~0;havoc ~irpSp___0~0;havoc ~irpSp__Context~0;havoc ~irpSp__Control~0;havoc ~__cil_tmp23~0;~status~0 := 0bv32;~devExt~0 := ~DeviceObject__DeviceExtension~0;~irpStack~0 := ~Irp__Tail__Overlay__CurrentStackLocation~0; {17210#true} is VALID [2018-11-23 10:49:15,590 INFO L273 TraceCheckUtils]: 22: Hoare triple {17210#true} assume !(0bv32 == ~irpStack__MinorFunction~0); {17210#true} is VALID [2018-11-23 10:49:15,590 INFO L273 TraceCheckUtils]: 23: Hoare triple {17210#true} assume 23bv32 == ~irpStack__MinorFunction~0; {17210#true} is VALID [2018-11-23 10:49:15,590 INFO L273 TraceCheckUtils]: 24: Hoare triple {17210#true} ~devExt__SurpriseRemoved~0 := 1bv32; {17210#true} is VALID [2018-11-23 10:49:15,590 INFO L273 TraceCheckUtils]: 25: Hoare triple {17210#true} assume ~s~0 == ~NP~0;~s~0 := ~SKIP1~0; {17210#true} is VALID [2018-11-23 10:49:15,590 INFO L273 TraceCheckUtils]: 26: Hoare triple {17210#true} #t~post8 := ~Irp__CurrentLocation~0;~Irp__CurrentLocation~0 := ~bvadd32(1bv32, #t~post8);havoc #t~post8;#t~post9 := ~Irp__Tail__Overlay__CurrentStackLocation~0;~Irp__Tail__Overlay__CurrentStackLocation~0 := ~bvadd32(1bv32, #t~post9);havoc #t~post9; {17210#true} is VALID [2018-11-23 10:49:15,590 INFO L256 TraceCheckUtils]: 27: Hoare triple {17210#true} call #t~ret10 := IofCallDriver(~devExt__TopOfStack~0, ~Irp); {17210#true} is VALID [2018-11-23 10:49:15,591 INFO L273 TraceCheckUtils]: 28: Hoare triple {17210#true} ~DeviceObject := #in~DeviceObject;~Irp := #in~Irp;havoc ~returnVal2~0;havoc ~compRetStatus~0;~lcontext~0 := #t~nondet30;havoc #t~nondet30;havoc ~__cil_tmp7~0; {17210#true} is VALID [2018-11-23 10:49:15,591 INFO L273 TraceCheckUtils]: 29: Hoare triple {17210#true} assume !(0bv32 != ~compRegistered~0); {17210#true} is VALID [2018-11-23 10:49:15,591 INFO L273 TraceCheckUtils]: 30: Hoare triple {17210#true} havoc ~tmp_ndt_6~0;~tmp_ndt_6~0 := #t~nondet32;havoc #t~nondet32; {17210#true} is VALID [2018-11-23 10:49:15,591 INFO L273 TraceCheckUtils]: 31: Hoare triple {17210#true} assume 0bv32 == ~tmp_ndt_6~0; {17210#true} is VALID [2018-11-23 10:49:15,591 INFO L273 TraceCheckUtils]: 32: Hoare triple {17210#true} ~returnVal2~0 := 0bv32; {17210#true} is VALID [2018-11-23 10:49:15,591 INFO L273 TraceCheckUtils]: 33: Hoare triple {17210#true} assume !(~s~0 == ~NP~0); {17210#true} is VALID [2018-11-23 10:49:15,591 INFO L273 TraceCheckUtils]: 34: Hoare triple {17210#true} assume !(~s~0 == ~MPR1~0); {17210#true} is VALID [2018-11-23 10:49:15,592 INFO L273 TraceCheckUtils]: 35: Hoare triple {17210#true} assume ~s~0 == ~SKIP1~0;~s~0 := ~SKIP2~0;~lowerDriverReturn~0 := ~returnVal2~0; {17320#(= ~lowerDriverReturn~0 IofCallDriver_~returnVal2~0)} is VALID [2018-11-23 10:49:15,592 INFO L273 TraceCheckUtils]: 36: Hoare triple {17320#(= ~lowerDriverReturn~0 IofCallDriver_~returnVal2~0)} #res := ~returnVal2~0; {17324#(= |IofCallDriver_#res| ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:15,592 INFO L273 TraceCheckUtils]: 37: Hoare triple {17324#(= |IofCallDriver_#res| ~lowerDriverReturn~0)} assume true; {17324#(= |IofCallDriver_#res| ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:15,593 INFO L268 TraceCheckUtils]: 38: Hoare quadruple {17324#(= |IofCallDriver_#res| ~lowerDriverReturn~0)} {17210#true} #779#return; {17331#(= ~lowerDriverReturn~0 |KbFilter_PnP_#t~ret10|)} is VALID [2018-11-23 10:49:15,594 INFO L273 TraceCheckUtils]: 39: Hoare triple {17331#(= ~lowerDriverReturn~0 |KbFilter_PnP_#t~ret10|)} ~status~0 := #t~ret10;havoc #t~ret10; {17335#(= KbFilter_PnP_~status~0 ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:15,594 INFO L273 TraceCheckUtils]: 40: Hoare triple {17335#(= KbFilter_PnP_~status~0 ~lowerDriverReturn~0)} #res := ~status~0; {17339#(= |KbFilter_PnP_#res| ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:15,595 INFO L273 TraceCheckUtils]: 41: Hoare triple {17339#(= |KbFilter_PnP_#res| ~lowerDriverReturn~0)} assume true; {17339#(= |KbFilter_PnP_#res| ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:15,596 INFO L268 TraceCheckUtils]: 42: Hoare quadruple {17339#(= |KbFilter_PnP_#res| ~lowerDriverReturn~0)} {17210#true} #725#return; {17346#(= |main_#t~ret27| ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:15,597 INFO L273 TraceCheckUtils]: 43: Hoare triple {17346#(= |main_#t~ret27| ~lowerDriverReturn~0)} ~status~1 := #t~ret27;havoc #t~ret27; {17350#(= main_~status~1 ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:15,597 INFO L273 TraceCheckUtils]: 44: Hoare triple {17350#(= main_~status~1 ~lowerDriverReturn~0)} assume !(1bv32 == ~pended~0); {17350#(= main_~status~1 ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:15,598 INFO L273 TraceCheckUtils]: 45: Hoare triple {17350#(= main_~status~1 ~lowerDriverReturn~0)} assume !(1bv32 == ~pended~0); {17350#(= main_~status~1 ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:15,598 INFO L273 TraceCheckUtils]: 46: Hoare triple {17350#(= main_~status~1 ~lowerDriverReturn~0)} assume ~s~0 != ~UNLOADED~0; {17350#(= main_~status~1 ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:15,599 INFO L273 TraceCheckUtils]: 47: Hoare triple {17350#(= main_~status~1 ~lowerDriverReturn~0)} assume 4294967295bv32 != ~status~1; {17350#(= main_~status~1 ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:15,599 INFO L273 TraceCheckUtils]: 48: Hoare triple {17350#(= main_~status~1 ~lowerDriverReturn~0)} assume !(~s~0 != ~SKIP2~0); {17350#(= main_~status~1 ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:15,600 INFO L273 TraceCheckUtils]: 49: Hoare triple {17350#(= main_~status~1 ~lowerDriverReturn~0)} assume !(1bv32 == ~pended~0); {17350#(= main_~status~1 ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:15,600 INFO L273 TraceCheckUtils]: 50: Hoare triple {17350#(= main_~status~1 ~lowerDriverReturn~0)} assume !(~s~0 == ~DC~0); {17350#(= main_~status~1 ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:15,601 INFO L273 TraceCheckUtils]: 51: Hoare triple {17350#(= main_~status~1 ~lowerDriverReturn~0)} assume ~status~1 != ~lowerDriverReturn~0; {17211#false} is VALID [2018-11-23 10:49:15,601 INFO L256 TraceCheckUtils]: 52: Hoare triple {17211#false} call errorFn(); {17211#false} is VALID [2018-11-23 10:49:15,601 INFO L273 TraceCheckUtils]: 53: Hoare triple {17211#false} assume !false; {17211#false} is VALID [2018-11-23 10:49:15,604 INFO L134 CoverageAnalysis]: Checked inductivity of 0 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 0 trivial. 0 not checked. [2018-11-23 10:49:15,604 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-23 10:49:15,606 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 10:49:15,606 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [9] imperfect sequences [] total 9 [2018-11-23 10:49:15,607 INFO L78 Accepts]: Start accepts. Automaton has 9 states. Word has length 54 [2018-11-23 10:49:15,607 INFO L84 Accepts]: Finished accepts. word is accepted. [2018-11-23 10:49:15,607 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 9 states. [2018-11-23 10:49:15,690 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 54 edges. 54 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:49:15,690 INFO L459 AbstractCegarLoop]: Interpolant automaton has 9 states [2018-11-23 10:49:15,690 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 9 interpolants. [2018-11-23 10:49:15,691 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=15, Invalid=57, Unknown=0, NotChecked=0, Total=72 [2018-11-23 10:49:15,691 INFO L87 Difference]: Start difference. First operand 213 states and 277 transitions. Second operand 9 states. [2018-11-23 10:49:19,958 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:49:19,958 INFO L93 Difference]: Finished difference Result 229 states and 293 transitions. [2018-11-23 10:49:19,959 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 9 states. [2018-11-23 10:49:19,959 INFO L78 Accepts]: Start accepts. Automaton has 9 states. Word has length 54 [2018-11-23 10:49:19,959 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 10:49:19,959 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 9 states. [2018-11-23 10:49:19,961 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 9 states to 9 states and 256 transitions. [2018-11-23 10:49:19,961 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 9 states. [2018-11-23 10:49:19,963 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 9 states to 9 states and 256 transitions. [2018-11-23 10:49:19,963 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 9 states and 256 transitions. [2018-11-23 10:49:20,250 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 256 edges. 256 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:49:20,255 INFO L225 Difference]: With dead ends: 229 [2018-11-23 10:49:20,255 INFO L226 Difference]: Without dead ends: 208 [2018-11-23 10:49:20,256 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 55 GetRequests, 46 SyntacticMatches, 0 SemanticMatches, 9 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 1 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=23, Invalid=87, Unknown=0, NotChecked=0, Total=110 [2018-11-23 10:49:20,256 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 208 states. [2018-11-23 10:49:20,682 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 208 to 208. [2018-11-23 10:49:20,682 INFO L214 AbstractMinimizeNwa]: Start testing correctness of minimizeSevpa [2018-11-23 10:49:20,682 INFO L82 GeneralOperation]: Start isEquivalent. First operand 208 states. Second operand 208 states. [2018-11-23 10:49:20,683 INFO L74 IsIncluded]: Start isIncluded. First operand 208 states. Second operand 208 states. [2018-11-23 10:49:20,683 INFO L87 Difference]: Start difference. First operand 208 states. Second operand 208 states. [2018-11-23 10:49:20,687 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:49:20,687 INFO L93 Difference]: Finished difference Result 208 states and 270 transitions. [2018-11-23 10:49:20,687 INFO L276 IsEmpty]: Start isEmpty. Operand 208 states and 270 transitions. [2018-11-23 10:49:20,688 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:49:20,688 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:49:20,688 INFO L74 IsIncluded]: Start isIncluded. First operand 208 states. Second operand 208 states. [2018-11-23 10:49:20,688 INFO L87 Difference]: Start difference. First operand 208 states. Second operand 208 states. [2018-11-23 10:49:20,692 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:49:20,692 INFO L93 Difference]: Finished difference Result 208 states and 270 transitions. [2018-11-23 10:49:20,692 INFO L276 IsEmpty]: Start isEmpty. Operand 208 states and 270 transitions. [2018-11-23 10:49:20,693 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:49:20,693 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:49:20,693 INFO L88 GeneralOperation]: Finished isEquivalent. [2018-11-23 10:49:20,693 INFO L221 AbstractMinimizeNwa]: Finished testing correctness of minimizeSevpa [2018-11-23 10:49:20,693 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 208 states. [2018-11-23 10:49:20,697 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 208 states to 208 states and 270 transitions. [2018-11-23 10:49:20,697 INFO L78 Accepts]: Start accepts. Automaton has 208 states and 270 transitions. Word has length 54 [2018-11-23 10:49:20,697 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 10:49:20,697 INFO L480 AbstractCegarLoop]: Abstraction has 208 states and 270 transitions. [2018-11-23 10:49:20,697 INFO L481 AbstractCegarLoop]: Interpolant automaton has 9 states. [2018-11-23 10:49:20,697 INFO L276 IsEmpty]: Start isEmpty. Operand 208 states and 270 transitions. [2018-11-23 10:49:20,698 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 58 [2018-11-23 10:49:20,698 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 10:49:20,698 INFO L402 BasicCegarLoop]: trace histogram [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 10:49:20,698 INFO L423 AbstractCegarLoop]: === Iteration 13 === [errorFnErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 10:49:20,699 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 10:49:20,699 INFO L82 PathProgramCache]: Analyzing trace with hash -527681510, now seen corresponding path program 1 times [2018-11-23 10:49:20,699 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 10:49:20,699 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/cvc4nyu Starting monitored process 14 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 14 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 10:49:20,727 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 10:49:20,897 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:49:20,988 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:49:20,990 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 10:49:21,113 INFO L256 TraceCheckUtils]: 0: Hoare triple {18388#true} call ULTIMATE.init(); {18388#true} is VALID [2018-11-23 10:49:21,113 INFO L273 TraceCheckUtils]: 1: Hoare triple {18388#true} ~KernelMode~0 := 0bv32;~Executive~0 := 0bv32;~DevicePowerState~0 := 0bv32;~s~0 := 0bv32;~UNLOADED~0 := 0bv32;~NP~0 := 0bv32;~DC~0 := 0bv32;~SKIP1~0 := 0bv32;~SKIP2~0 := 0bv32;~MPR1~0 := 0bv32;~MPR3~0 := 0bv32;~IPC~0 := 0bv32;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32;~myStatus~0 := 0bv32; {18388#true} is VALID [2018-11-23 10:49:21,113 INFO L273 TraceCheckUtils]: 2: Hoare triple {18388#true} assume true; {18388#true} is VALID [2018-11-23 10:49:21,114 INFO L268 TraceCheckUtils]: 3: Hoare quadruple {18388#true} {18388#true} #759#return; {18388#true} is VALID [2018-11-23 10:49:21,114 INFO L256 TraceCheckUtils]: 4: Hoare triple {18388#true} call #t~ret77 := main(); {18388#true} is VALID [2018-11-23 10:49:21,114 INFO L273 TraceCheckUtils]: 5: Hoare triple {18388#true} havoc ~status~1;~irp~0 := #t~nondet17;havoc #t~nondet17;havoc ~pirp~0;havoc ~pirp__IoStatus__Status~0;~irp_choice~0 := #t~nondet18;havoc #t~nondet18;~devobj~0 := #t~nondet19;havoc #t~nondet19;havoc ~__cil_tmp8~0;~KernelMode~0 := 0bv32;~Executive~0 := 0bv32;~DevicePowerState~0 := 1bv32;~s~0 := 0bv32;~UNLOADED~0 := 0bv32;~NP~0 := 0bv32;~DC~0 := 0bv32;~SKIP1~0 := 0bv32;~SKIP2~0 := 0bv32;~MPR1~0 := 0bv32;~MPR3~0 := 0bv32;~IPC~0 := 0bv32;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32;~myStatus~0 := 0bv32;~status~1 := 0bv32;~pirp~0 := ~irp~0; {18388#true} is VALID [2018-11-23 10:49:21,115 INFO L256 TraceCheckUtils]: 6: Hoare triple {18388#true} call _BLAST_init(); {18388#true} is VALID [2018-11-23 10:49:21,115 INFO L273 TraceCheckUtils]: 7: Hoare triple {18388#true} ~UNLOADED~0 := 0bv32;~NP~0 := 1bv32;~DC~0 := 2bv32;~SKIP1~0 := 3bv32;~SKIP2~0 := 4bv32;~MPR1~0 := 5bv32;~MPR3~0 := 6bv32;~IPC~0 := 7bv32;~s~0 := ~UNLOADED~0;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32; {18388#true} is VALID [2018-11-23 10:49:21,115 INFO L273 TraceCheckUtils]: 8: Hoare triple {18388#true} assume true; {18388#true} is VALID [2018-11-23 10:49:21,115 INFO L268 TraceCheckUtils]: 9: Hoare quadruple {18388#true} {18388#true} #717#return; {18388#true} is VALID [2018-11-23 10:49:21,116 INFO L273 TraceCheckUtils]: 10: Hoare triple {18388#true} assume ~bvsge32(~status~1, 0bv32);~s~0 := ~NP~0;~customIrp~0 := 0bv32;~setEventCalled~0 := ~customIrp~0;~lowerDriverReturn~0 := ~setEventCalled~0;~compRegistered~0 := ~lowerDriverReturn~0;~pended~0 := ~compRegistered~0;~pirp__IoStatus__Status~0 := 0bv32;~myStatus~0 := 0bv32; {18388#true} is VALID [2018-11-23 10:49:21,116 INFO L273 TraceCheckUtils]: 11: Hoare triple {18388#true} assume !(0bv32 == ~irp_choice~0); {18388#true} is VALID [2018-11-23 10:49:21,116 INFO L256 TraceCheckUtils]: 12: Hoare triple {18388#true} call stub_driver_init(); {18388#true} is VALID [2018-11-23 10:49:21,116 INFO L273 TraceCheckUtils]: 13: Hoare triple {18388#true} ~s~0 := ~NP~0;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32; {18388#true} is VALID [2018-11-23 10:49:21,116 INFO L273 TraceCheckUtils]: 14: Hoare triple {18388#true} assume true; {18388#true} is VALID [2018-11-23 10:49:21,117 INFO L268 TraceCheckUtils]: 15: Hoare quadruple {18388#true} {18388#true} #719#return; {18388#true} is VALID [2018-11-23 10:49:21,117 INFO L273 TraceCheckUtils]: 16: Hoare triple {18388#true} assume !~bvslt32(~status~1, 0bv32);havoc ~tmp_ndt_1~0;~tmp_ndt_1~0 := #t~nondet20;havoc #t~nondet20; {18388#true} is VALID [2018-11-23 10:49:21,117 INFO L273 TraceCheckUtils]: 17: Hoare triple {18388#true} assume !(0bv32 == ~tmp_ndt_1~0);havoc ~tmp_ndt_2~0;~tmp_ndt_2~0 := #t~nondet21;havoc #t~nondet21; {18388#true} is VALID [2018-11-23 10:49:21,117 INFO L273 TraceCheckUtils]: 18: Hoare triple {18388#true} assume !(1bv32 == ~tmp_ndt_2~0);havoc ~tmp_ndt_3~0;~tmp_ndt_3~0 := #t~nondet22;havoc #t~nondet22; {18388#true} is VALID [2018-11-23 10:49:21,117 INFO L273 TraceCheckUtils]: 19: Hoare triple {18388#true} assume 3bv32 == ~tmp_ndt_3~0; {18388#true} is VALID [2018-11-23 10:49:21,117 INFO L256 TraceCheckUtils]: 20: Hoare triple {18388#true} call #t~ret27 := KbFilter_PnP(~devobj~0, ~pirp~0); {18388#true} is VALID [2018-11-23 10:49:21,118 INFO L273 TraceCheckUtils]: 21: Hoare triple {18388#true} ~DeviceObject := #in~DeviceObject;~Irp := #in~Irp;havoc ~devExt~0;havoc ~irpStack~0;havoc ~status~0;~event~0 := #t~nondet0;havoc #t~nondet0;~DeviceObject__DeviceExtension~0 := #t~nondet1;havoc #t~nondet1;~Irp__Tail__Overlay__CurrentStackLocation~0 := #t~nondet2;havoc #t~nondet2;~irpStack__MinorFunction~0 := #t~nondet3;havoc #t~nondet3;~devExt__TopOfStack~0 := #t~nondet4;havoc #t~nondet4;havoc ~devExt__Started~0;havoc ~devExt__Removed~0;havoc ~devExt__SurpriseRemoved~0;havoc ~Irp__IoStatus__Status~0;havoc ~Irp__IoStatus__Information~0;~Irp__CurrentLocation~0 := #t~nondet5;havoc #t~nondet5;havoc ~irpSp~0;havoc ~nextIrpSp~0;havoc ~nextIrpSp__Control~0;havoc ~irpSp___0~0;havoc ~irpSp__Context~0;havoc ~irpSp__Control~0;havoc ~__cil_tmp23~0;~status~0 := 0bv32;~devExt~0 := ~DeviceObject__DeviceExtension~0;~irpStack~0 := ~Irp__Tail__Overlay__CurrentStackLocation~0; {18388#true} is VALID [2018-11-23 10:49:21,118 INFO L273 TraceCheckUtils]: 22: Hoare triple {18388#true} assume 0bv32 == ~irpStack__MinorFunction~0; {18388#true} is VALID [2018-11-23 10:49:21,118 INFO L273 TraceCheckUtils]: 23: Hoare triple {18388#true} ~irpSp~0 := ~Irp__Tail__Overlay__CurrentStackLocation~0;~nextIrpSp~0 := ~bvsub32(~Irp__Tail__Overlay__CurrentStackLocation~0, 1bv32);~nextIrpSp__Control~0 := 0bv32; {18388#true} is VALID [2018-11-23 10:49:21,118 INFO L273 TraceCheckUtils]: 24: Hoare triple {18388#true} assume !(~s~0 != ~NP~0); {18388#true} is VALID [2018-11-23 10:49:21,118 INFO L273 TraceCheckUtils]: 25: Hoare triple {18388#true} assume !(0bv32 != ~compRegistered~0);~compRegistered~0 := 1bv32; {18388#true} is VALID [2018-11-23 10:49:21,119 INFO L273 TraceCheckUtils]: 26: Hoare triple {18388#true} ~irpSp___0~0 := ~bvsub32(~Irp__Tail__Overlay__CurrentStackLocation~0, 1bv32);~irpSp__Context~0 := ~event~0;~irpSp__Control~0 := 224bv32; {18388#true} is VALID [2018-11-23 10:49:21,119 INFO L256 TraceCheckUtils]: 27: Hoare triple {18388#true} call #t~ret6 := IofCallDriver(~devExt__TopOfStack~0, ~Irp); {18388#true} is VALID [2018-11-23 10:49:21,119 INFO L273 TraceCheckUtils]: 28: Hoare triple {18388#true} ~DeviceObject := #in~DeviceObject;~Irp := #in~Irp;havoc ~returnVal2~0;havoc ~compRetStatus~0;~lcontext~0 := #t~nondet30;havoc #t~nondet30;havoc ~__cil_tmp7~0; {18388#true} is VALID [2018-11-23 10:49:21,119 INFO L273 TraceCheckUtils]: 29: Hoare triple {18388#true} assume 0bv32 != ~compRegistered~0; {18388#true} is VALID [2018-11-23 10:49:21,119 INFO L256 TraceCheckUtils]: 30: Hoare triple {18388#true} call #t~ret31 := KbFilter_Complete(~DeviceObject, ~Irp, ~lcontext~0); {18388#true} is VALID [2018-11-23 10:49:21,119 INFO L273 TraceCheckUtils]: 31: Hoare triple {18388#true} ~DeviceObject := #in~DeviceObject;~Irp := #in~Irp;~Context := #in~Context;havoc ~event~1;~event~1 := ~Context; {18388#true} is VALID [2018-11-23 10:49:21,120 INFO L256 TraceCheckUtils]: 32: Hoare triple {18388#true} call #t~ret36 := KeSetEvent(~event~1, 0bv32, 0bv32); {18388#true} is VALID [2018-11-23 10:49:21,120 INFO L273 TraceCheckUtils]: 33: Hoare triple {18388#true} ~Event := #in~Event;~Increment := #in~Increment;~Wait := #in~Wait;~l~0 := #t~nondet34;havoc #t~nondet34;~setEventCalled~0 := 1bv32;#res := ~l~0; {18388#true} is VALID [2018-11-23 10:49:21,120 INFO L273 TraceCheckUtils]: 34: Hoare triple {18388#true} assume true; {18388#true} is VALID [2018-11-23 10:49:21,120 INFO L268 TraceCheckUtils]: 35: Hoare quadruple {18388#true} {18388#true} #711#return; {18388#true} is VALID [2018-11-23 10:49:21,134 INFO L273 TraceCheckUtils]: 36: Hoare triple {18388#true} havoc #t~ret36;#res := 3221225494bv32; {18501#(= (_ bv3221225494 32) |KbFilter_Complete_#res|)} is VALID [2018-11-23 10:49:21,134 INFO L273 TraceCheckUtils]: 37: Hoare triple {18501#(= (_ bv3221225494 32) |KbFilter_Complete_#res|)} assume true; {18501#(= (_ bv3221225494 32) |KbFilter_Complete_#res|)} is VALID [2018-11-23 10:49:21,135 INFO L268 TraceCheckUtils]: 38: Hoare quadruple {18501#(= (_ bv3221225494 32) |KbFilter_Complete_#res|)} {18388#true} #735#return; {18508#(= (_ bv3221225494 32) |IofCallDriver_#t~ret31|)} is VALID [2018-11-23 10:49:21,143 INFO L273 TraceCheckUtils]: 39: Hoare triple {18508#(= (_ bv3221225494 32) |IofCallDriver_#t~ret31|)} ~compRetStatus~0 := #t~ret31;havoc #t~ret31;~__cil_tmp7~0 := ~sign_extendFrom32To64(~compRetStatus~0); {18512#(= IofCallDriver_~__cil_tmp7~0 ((_ sign_extend 32) (_ bv3221225494 32)))} is VALID [2018-11-23 10:49:21,143 INFO L273 TraceCheckUtils]: 40: Hoare triple {18512#(= IofCallDriver_~__cil_tmp7~0 ((_ sign_extend 32) (_ bv3221225494 32)))} assume !(~__cil_tmp7~0 == ~sign_extendFrom32To64(3221225494bv32)); {18389#false} is VALID [2018-11-23 10:49:21,143 INFO L273 TraceCheckUtils]: 41: Hoare triple {18389#false} havoc ~tmp_ndt_6~0;~tmp_ndt_6~0 := #t~nondet32;havoc #t~nondet32; {18389#false} is VALID [2018-11-23 10:49:21,144 INFO L273 TraceCheckUtils]: 42: Hoare triple {18389#false} assume 0bv32 == ~tmp_ndt_6~0; {18389#false} is VALID [2018-11-23 10:49:21,144 INFO L273 TraceCheckUtils]: 43: Hoare triple {18389#false} ~returnVal2~0 := 0bv32; {18389#false} is VALID [2018-11-23 10:49:21,144 INFO L273 TraceCheckUtils]: 44: Hoare triple {18389#false} assume ~s~0 == ~NP~0;~s~0 := ~IPC~0;~lowerDriverReturn~0 := ~returnVal2~0; {18389#false} is VALID [2018-11-23 10:49:21,144 INFO L273 TraceCheckUtils]: 45: Hoare triple {18389#false} #res := ~returnVal2~0; {18389#false} is VALID [2018-11-23 10:49:21,144 INFO L273 TraceCheckUtils]: 46: Hoare triple {18389#false} assume true; {18389#false} is VALID [2018-11-23 10:49:21,144 INFO L268 TraceCheckUtils]: 47: Hoare quadruple {18389#false} {18388#true} #771#return; {18389#false} is VALID [2018-11-23 10:49:21,144 INFO L273 TraceCheckUtils]: 48: Hoare triple {18389#false} ~status~0 := #t~ret6;havoc #t~ret6;~__cil_tmp23~0 := ~status~0; {18389#false} is VALID [2018-11-23 10:49:21,145 INFO L273 TraceCheckUtils]: 49: Hoare triple {18389#false} assume !(259bv32 == ~__cil_tmp23~0); {18389#false} is VALID [2018-11-23 10:49:21,145 INFO L273 TraceCheckUtils]: 50: Hoare triple {18389#false} assume !~bvsge32(~status~0, 0bv32); {18389#false} is VALID [2018-11-23 10:49:21,145 INFO L273 TraceCheckUtils]: 51: Hoare triple {18389#false} ~Irp__IoStatus__Status~0 := ~status~0;~myStatus~0 := ~status~0;~Irp__IoStatus__Information~0 := 0bv32; {18389#false} is VALID [2018-11-23 10:49:21,145 INFO L256 TraceCheckUtils]: 52: Hoare triple {18389#false} call IofCompleteRequest(~Irp, 0bv32); {18389#false} is VALID [2018-11-23 10:49:21,145 INFO L273 TraceCheckUtils]: 53: Hoare triple {18389#false} ~Irp := #in~Irp;~PriorityBoost := #in~PriorityBoost; {18389#false} is VALID [2018-11-23 10:49:21,145 INFO L273 TraceCheckUtils]: 54: Hoare triple {18389#false} assume !(~s~0 == ~NP~0); {18389#false} is VALID [2018-11-23 10:49:21,145 INFO L256 TraceCheckUtils]: 55: Hoare triple {18389#false} call errorFn(); {18389#false} is VALID [2018-11-23 10:49:21,145 INFO L273 TraceCheckUtils]: 56: Hoare triple {18389#false} assume !false; {18389#false} is VALID [2018-11-23 10:49:21,147 INFO L134 CoverageAnalysis]: Checked inductivity of 0 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 0 trivial. 0 not checked. [2018-11-23 10:49:21,147 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-23 10:49:21,149 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 10:49:21,149 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [5] imperfect sequences [] total 5 [2018-11-23 10:49:21,149 INFO L78 Accepts]: Start accepts. Automaton has 5 states. Word has length 57 [2018-11-23 10:49:21,150 INFO L84 Accepts]: Finished accepts. word is accepted. [2018-11-23 10:49:21,150 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 5 states. [2018-11-23 10:49:21,218 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 57 edges. 57 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:49:21,218 INFO L459 AbstractCegarLoop]: Interpolant automaton has 5 states [2018-11-23 10:49:21,219 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 5 interpolants. [2018-11-23 10:49:21,219 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=7, Invalid=13, Unknown=0, NotChecked=0, Total=20 [2018-11-23 10:49:21,219 INFO L87 Difference]: Start difference. First operand 208 states and 270 transitions. Second operand 5 states. [2018-11-23 10:49:23,509 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:49:23,509 INFO L93 Difference]: Finished difference Result 238 states and 305 transitions. [2018-11-23 10:49:23,509 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 5 states. [2018-11-23 10:49:23,509 INFO L78 Accepts]: Start accepts. Automaton has 5 states. Word has length 57 [2018-11-23 10:49:23,509 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 10:49:23,509 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 5 states. [2018-11-23 10:49:23,512 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 5 states to 5 states and 289 transitions. [2018-11-23 10:49:23,512 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 5 states. [2018-11-23 10:49:23,514 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 5 states to 5 states and 289 transitions. [2018-11-23 10:49:23,514 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 5 states and 289 transitions. [2018-11-23 10:49:23,842 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 289 edges. 289 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:49:23,846 INFO L225 Difference]: With dead ends: 238 [2018-11-23 10:49:23,846 INFO L226 Difference]: Without dead ends: 201 [2018-11-23 10:49:23,846 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 56 GetRequests, 53 SyntacticMatches, 0 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=7, Invalid=13, Unknown=0, NotChecked=0, Total=20 [2018-11-23 10:49:23,846 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 201 states. [2018-11-23 10:49:24,190 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 201 to 201. [2018-11-23 10:49:24,190 INFO L214 AbstractMinimizeNwa]: Start testing correctness of minimizeSevpa [2018-11-23 10:49:24,190 INFO L82 GeneralOperation]: Start isEquivalent. First operand 201 states. Second operand 201 states. [2018-11-23 10:49:24,190 INFO L74 IsIncluded]: Start isIncluded. First operand 201 states. Second operand 201 states. [2018-11-23 10:49:24,190 INFO L87 Difference]: Start difference. First operand 201 states. Second operand 201 states. [2018-11-23 10:49:24,195 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:49:24,195 INFO L93 Difference]: Finished difference Result 201 states and 260 transitions. [2018-11-23 10:49:24,195 INFO L276 IsEmpty]: Start isEmpty. Operand 201 states and 260 transitions. [2018-11-23 10:49:24,196 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:49:24,196 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:49:24,196 INFO L74 IsIncluded]: Start isIncluded. First operand 201 states. Second operand 201 states. [2018-11-23 10:49:24,196 INFO L87 Difference]: Start difference. First operand 201 states. Second operand 201 states. [2018-11-23 10:49:24,201 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:49:24,201 INFO L93 Difference]: Finished difference Result 201 states and 260 transitions. [2018-11-23 10:49:24,201 INFO L276 IsEmpty]: Start isEmpty. Operand 201 states and 260 transitions. [2018-11-23 10:49:24,201 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:49:24,202 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:49:24,202 INFO L88 GeneralOperation]: Finished isEquivalent. [2018-11-23 10:49:24,202 INFO L221 AbstractMinimizeNwa]: Finished testing correctness of minimizeSevpa [2018-11-23 10:49:24,202 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 201 states. [2018-11-23 10:49:24,205 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 201 states to 201 states and 260 transitions. [2018-11-23 10:49:24,206 INFO L78 Accepts]: Start accepts. Automaton has 201 states and 260 transitions. Word has length 57 [2018-11-23 10:49:24,206 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 10:49:24,206 INFO L480 AbstractCegarLoop]: Abstraction has 201 states and 260 transitions. [2018-11-23 10:49:24,206 INFO L481 AbstractCegarLoop]: Interpolant automaton has 5 states. [2018-11-23 10:49:24,206 INFO L276 IsEmpty]: Start isEmpty. Operand 201 states and 260 transitions. [2018-11-23 10:49:24,206 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 58 [2018-11-23 10:49:24,207 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 10:49:24,207 INFO L402 BasicCegarLoop]: trace histogram [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 10:49:24,207 INFO L423 AbstractCegarLoop]: === Iteration 14 === [errorFnErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 10:49:24,207 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 10:49:24,207 INFO L82 PathProgramCache]: Analyzing trace with hash -833535160, now seen corresponding path program 1 times [2018-11-23 10:49:24,207 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 10:49:24,207 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/cvc4nyu Starting monitored process 15 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 15 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 10:49:24,235 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 10:49:24,317 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:49:24,346 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:49:24,347 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 10:49:24,481 INFO L256 TraceCheckUtils]: 0: Hoare triple {19553#true} call ULTIMATE.init(); {19553#true} is VALID [2018-11-23 10:49:24,482 INFO L273 TraceCheckUtils]: 1: Hoare triple {19553#true} ~KernelMode~0 := 0bv32;~Executive~0 := 0bv32;~DevicePowerState~0 := 0bv32;~s~0 := 0bv32;~UNLOADED~0 := 0bv32;~NP~0 := 0bv32;~DC~0 := 0bv32;~SKIP1~0 := 0bv32;~SKIP2~0 := 0bv32;~MPR1~0 := 0bv32;~MPR3~0 := 0bv32;~IPC~0 := 0bv32;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32;~myStatus~0 := 0bv32; {19553#true} is VALID [2018-11-23 10:49:24,482 INFO L273 TraceCheckUtils]: 2: Hoare triple {19553#true} assume true; {19553#true} is VALID [2018-11-23 10:49:24,482 INFO L268 TraceCheckUtils]: 3: Hoare quadruple {19553#true} {19553#true} #759#return; {19553#true} is VALID [2018-11-23 10:49:24,482 INFO L256 TraceCheckUtils]: 4: Hoare triple {19553#true} call #t~ret77 := main(); {19553#true} is VALID [2018-11-23 10:49:24,483 INFO L273 TraceCheckUtils]: 5: Hoare triple {19553#true} havoc ~status~1;~irp~0 := #t~nondet17;havoc #t~nondet17;havoc ~pirp~0;havoc ~pirp__IoStatus__Status~0;~irp_choice~0 := #t~nondet18;havoc #t~nondet18;~devobj~0 := #t~nondet19;havoc #t~nondet19;havoc ~__cil_tmp8~0;~KernelMode~0 := 0bv32;~Executive~0 := 0bv32;~DevicePowerState~0 := 1bv32;~s~0 := 0bv32;~UNLOADED~0 := 0bv32;~NP~0 := 0bv32;~DC~0 := 0bv32;~SKIP1~0 := 0bv32;~SKIP2~0 := 0bv32;~MPR1~0 := 0bv32;~MPR3~0 := 0bv32;~IPC~0 := 0bv32;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32;~myStatus~0 := 0bv32;~status~1 := 0bv32;~pirp~0 := ~irp~0; {19553#true} is VALID [2018-11-23 10:49:24,483 INFO L256 TraceCheckUtils]: 6: Hoare triple {19553#true} call _BLAST_init(); {19553#true} is VALID [2018-11-23 10:49:24,483 INFO L273 TraceCheckUtils]: 7: Hoare triple {19553#true} ~UNLOADED~0 := 0bv32;~NP~0 := 1bv32;~DC~0 := 2bv32;~SKIP1~0 := 3bv32;~SKIP2~0 := 4bv32;~MPR1~0 := 5bv32;~MPR3~0 := 6bv32;~IPC~0 := 7bv32;~s~0 := ~UNLOADED~0;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32; {19553#true} is VALID [2018-11-23 10:49:24,483 INFO L273 TraceCheckUtils]: 8: Hoare triple {19553#true} assume true; {19553#true} is VALID [2018-11-23 10:49:24,483 INFO L268 TraceCheckUtils]: 9: Hoare quadruple {19553#true} {19553#true} #717#return; {19553#true} is VALID [2018-11-23 10:49:24,484 INFO L273 TraceCheckUtils]: 10: Hoare triple {19553#true} assume ~bvsge32(~status~1, 0bv32);~s~0 := ~NP~0;~customIrp~0 := 0bv32;~setEventCalled~0 := ~customIrp~0;~lowerDriverReturn~0 := ~setEventCalled~0;~compRegistered~0 := ~lowerDriverReturn~0;~pended~0 := ~compRegistered~0;~pirp__IoStatus__Status~0 := 0bv32;~myStatus~0 := 0bv32; {19553#true} is VALID [2018-11-23 10:49:24,484 INFO L273 TraceCheckUtils]: 11: Hoare triple {19553#true} assume !(0bv32 == ~irp_choice~0); {19553#true} is VALID [2018-11-23 10:49:24,484 INFO L256 TraceCheckUtils]: 12: Hoare triple {19553#true} call stub_driver_init(); {19553#true} is VALID [2018-11-23 10:49:24,484 INFO L273 TraceCheckUtils]: 13: Hoare triple {19553#true} ~s~0 := ~NP~0;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32; {19553#true} is VALID [2018-11-23 10:49:24,484 INFO L273 TraceCheckUtils]: 14: Hoare triple {19553#true} assume true; {19553#true} is VALID [2018-11-23 10:49:24,484 INFO L268 TraceCheckUtils]: 15: Hoare quadruple {19553#true} {19553#true} #719#return; {19553#true} is VALID [2018-11-23 10:49:24,484 INFO L273 TraceCheckUtils]: 16: Hoare triple {19553#true} assume !~bvslt32(~status~1, 0bv32);havoc ~tmp_ndt_1~0;~tmp_ndt_1~0 := #t~nondet20;havoc #t~nondet20; {19553#true} is VALID [2018-11-23 10:49:24,484 INFO L273 TraceCheckUtils]: 17: Hoare triple {19553#true} assume !(0bv32 == ~tmp_ndt_1~0);havoc ~tmp_ndt_2~0;~tmp_ndt_2~0 := #t~nondet21;havoc #t~nondet21; {19553#true} is VALID [2018-11-23 10:49:24,485 INFO L273 TraceCheckUtils]: 18: Hoare triple {19553#true} assume 1bv32 == ~tmp_ndt_2~0; {19553#true} is VALID [2018-11-23 10:49:24,485 INFO L256 TraceCheckUtils]: 19: Hoare triple {19553#true} call #t~ret26 := KbFilter_CreateClose(~devobj~0, ~pirp~0); {19553#true} is VALID [2018-11-23 10:49:24,485 INFO L273 TraceCheckUtils]: 20: Hoare triple {19553#true} ~DeviceObject := #in~DeviceObject;~Irp := #in~Irp;~irpStack__MajorFunction~0 := #t~nondet37;havoc #t~nondet37;~devExt__UpperConnectData__ClassService~0 := #t~nondet38;havoc #t~nondet38;havoc ~Irp__IoStatus__Status~1;havoc ~status~2;havoc ~tmp~0;~status~2 := ~myStatus~0; {19553#true} is VALID [2018-11-23 10:49:24,485 INFO L273 TraceCheckUtils]: 21: Hoare triple {19553#true} assume 0bv32 == ~irpStack__MajorFunction~0; {19553#true} is VALID [2018-11-23 10:49:24,485 INFO L273 TraceCheckUtils]: 22: Hoare triple {19553#true} assume 0bv32 == ~devExt__UpperConnectData__ClassService~0;~status~2 := 3221225860bv32; {19553#true} is VALID [2018-11-23 10:49:24,485 INFO L273 TraceCheckUtils]: 23: Hoare triple {19553#true} ~Irp__IoStatus__Status~1 := ~status~2;~myStatus~0 := ~status~2; {19553#true} is VALID [2018-11-23 10:49:24,485 INFO L256 TraceCheckUtils]: 24: Hoare triple {19553#true} call #t~ret39 := KbFilter_DispatchPassThrough(~DeviceObject, ~Irp); {19553#true} is VALID [2018-11-23 10:49:24,485 INFO L273 TraceCheckUtils]: 25: Hoare triple {19553#true} ~DeviceObject := #in~DeviceObject;~Irp := #in~Irp;~Irp__Tail__Overlay__CurrentStackLocation~1 := #t~nondet40;havoc #t~nondet40;~Irp__CurrentLocation~1 := #t~nondet41;havoc #t~nondet41;~DeviceObject__DeviceExtension__TopOfStack~0 := #t~nondet42;havoc #t~nondet42;havoc ~irpStack~1;havoc ~tmp~1;~irpStack~1 := ~Irp__Tail__Overlay__CurrentStackLocation~1; {19553#true} is VALID [2018-11-23 10:49:24,486 INFO L273 TraceCheckUtils]: 26: Hoare triple {19553#true} assume ~s~0 == ~NP~0;~s~0 := ~SKIP1~0; {19553#true} is VALID [2018-11-23 10:49:24,486 INFO L273 TraceCheckUtils]: 27: Hoare triple {19553#true} #t~post43 := ~Irp__CurrentLocation~1;~Irp__CurrentLocation~1 := ~bvadd32(1bv32, #t~post43);havoc #t~post43;#t~post44 := ~Irp__Tail__Overlay__CurrentStackLocation~1;~Irp__Tail__Overlay__CurrentStackLocation~1 := ~bvadd32(1bv32, #t~post44);havoc #t~post44; {19553#true} is VALID [2018-11-23 10:49:24,486 INFO L256 TraceCheckUtils]: 28: Hoare triple {19553#true} call #t~ret45 := IofCallDriver(~DeviceObject__DeviceExtension__TopOfStack~0, ~Irp); {19553#true} is VALID [2018-11-23 10:49:24,486 INFO L273 TraceCheckUtils]: 29: Hoare triple {19553#true} ~DeviceObject := #in~DeviceObject;~Irp := #in~Irp;havoc ~returnVal2~0;havoc ~compRetStatus~0;~lcontext~0 := #t~nondet30;havoc #t~nondet30;havoc ~__cil_tmp7~0; {19553#true} is VALID [2018-11-23 10:49:24,486 INFO L273 TraceCheckUtils]: 30: Hoare triple {19553#true} assume !(0bv32 != ~compRegistered~0); {19553#true} is VALID [2018-11-23 10:49:24,486 INFO L273 TraceCheckUtils]: 31: Hoare triple {19553#true} havoc ~tmp_ndt_6~0;~tmp_ndt_6~0 := #t~nondet32;havoc #t~nondet32; {19553#true} is VALID [2018-11-23 10:49:24,486 INFO L273 TraceCheckUtils]: 32: Hoare triple {19553#true} assume 0bv32 == ~tmp_ndt_6~0; {19553#true} is VALID [2018-11-23 10:49:24,486 INFO L273 TraceCheckUtils]: 33: Hoare triple {19553#true} ~returnVal2~0 := 0bv32; {19553#true} is VALID [2018-11-23 10:49:24,487 INFO L273 TraceCheckUtils]: 34: Hoare triple {19553#true} assume !(~s~0 == ~NP~0); {19553#true} is VALID [2018-11-23 10:49:24,487 INFO L273 TraceCheckUtils]: 35: Hoare triple {19553#true} assume !(~s~0 == ~MPR1~0); {19553#true} is VALID [2018-11-23 10:49:24,487 INFO L273 TraceCheckUtils]: 36: Hoare triple {19553#true} assume ~s~0 == ~SKIP1~0;~s~0 := ~SKIP2~0;~lowerDriverReturn~0 := ~returnVal2~0; {19666#(= ~lowerDriverReturn~0 IofCallDriver_~returnVal2~0)} is VALID [2018-11-23 10:49:24,487 INFO L273 TraceCheckUtils]: 37: Hoare triple {19666#(= ~lowerDriverReturn~0 IofCallDriver_~returnVal2~0)} #res := ~returnVal2~0; {19670#(= |IofCallDriver_#res| ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:24,488 INFO L273 TraceCheckUtils]: 38: Hoare triple {19670#(= |IofCallDriver_#res| ~lowerDriverReturn~0)} assume true; {19670#(= |IofCallDriver_#res| ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:24,488 INFO L268 TraceCheckUtils]: 39: Hoare quadruple {19670#(= |IofCallDriver_#res| ~lowerDriverReturn~0)} {19553#true} #765#return; {19677#(= |KbFilter_DispatchPassThrough_#t~ret45| ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:24,489 INFO L273 TraceCheckUtils]: 40: Hoare triple {19677#(= |KbFilter_DispatchPassThrough_#t~ret45| ~lowerDriverReturn~0)} ~tmp~1 := #t~ret45;havoc #t~ret45;#res := ~tmp~1; {19681#(= ~lowerDriverReturn~0 |KbFilter_DispatchPassThrough_#res|)} is VALID [2018-11-23 10:49:24,489 INFO L273 TraceCheckUtils]: 41: Hoare triple {19681#(= ~lowerDriverReturn~0 |KbFilter_DispatchPassThrough_#res|)} assume true; {19681#(= ~lowerDriverReturn~0 |KbFilter_DispatchPassThrough_#res|)} is VALID [2018-11-23 10:49:24,490 INFO L268 TraceCheckUtils]: 42: Hoare quadruple {19681#(= ~lowerDriverReturn~0 |KbFilter_DispatchPassThrough_#res|)} {19553#true} #749#return; {19688#(= |KbFilter_CreateClose_#t~ret39| ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:24,490 INFO L273 TraceCheckUtils]: 43: Hoare triple {19688#(= |KbFilter_CreateClose_#t~ret39| ~lowerDriverReturn~0)} ~tmp~0 := #t~ret39;havoc #t~ret39;#res := ~tmp~0; {19692#(= ~lowerDriverReturn~0 |KbFilter_CreateClose_#res|)} is VALID [2018-11-23 10:49:24,501 INFO L273 TraceCheckUtils]: 44: Hoare triple {19692#(= ~lowerDriverReturn~0 |KbFilter_CreateClose_#res|)} assume true; {19692#(= ~lowerDriverReturn~0 |KbFilter_CreateClose_#res|)} is VALID [2018-11-23 10:49:24,502 INFO L268 TraceCheckUtils]: 45: Hoare quadruple {19692#(= ~lowerDriverReturn~0 |KbFilter_CreateClose_#res|)} {19553#true} #723#return; {19699#(= |main_#t~ret26| ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:24,502 INFO L273 TraceCheckUtils]: 46: Hoare triple {19699#(= |main_#t~ret26| ~lowerDriverReturn~0)} ~status~1 := #t~ret26;havoc #t~ret26; {19703#(= main_~status~1 ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:24,503 INFO L273 TraceCheckUtils]: 47: Hoare triple {19703#(= main_~status~1 ~lowerDriverReturn~0)} assume !(1bv32 == ~pended~0); {19703#(= main_~status~1 ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:24,503 INFO L273 TraceCheckUtils]: 48: Hoare triple {19703#(= main_~status~1 ~lowerDriverReturn~0)} assume !(1bv32 == ~pended~0); {19703#(= main_~status~1 ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:24,503 INFO L273 TraceCheckUtils]: 49: Hoare triple {19703#(= main_~status~1 ~lowerDriverReturn~0)} assume ~s~0 != ~UNLOADED~0; {19703#(= main_~status~1 ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:24,504 INFO L273 TraceCheckUtils]: 50: Hoare triple {19703#(= main_~status~1 ~lowerDriverReturn~0)} assume 4294967295bv32 != ~status~1; {19703#(= main_~status~1 ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:24,504 INFO L273 TraceCheckUtils]: 51: Hoare triple {19703#(= main_~status~1 ~lowerDriverReturn~0)} assume !(~s~0 != ~SKIP2~0); {19703#(= main_~status~1 ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:24,504 INFO L273 TraceCheckUtils]: 52: Hoare triple {19703#(= main_~status~1 ~lowerDriverReturn~0)} assume !(1bv32 == ~pended~0); {19703#(= main_~status~1 ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:24,505 INFO L273 TraceCheckUtils]: 53: Hoare triple {19703#(= main_~status~1 ~lowerDriverReturn~0)} assume !(~s~0 == ~DC~0); {19703#(= main_~status~1 ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:24,505 INFO L273 TraceCheckUtils]: 54: Hoare triple {19703#(= main_~status~1 ~lowerDriverReturn~0)} assume ~status~1 != ~lowerDriverReturn~0; {19554#false} is VALID [2018-11-23 10:49:24,505 INFO L256 TraceCheckUtils]: 55: Hoare triple {19554#false} call errorFn(); {19554#false} is VALID [2018-11-23 10:49:24,505 INFO L273 TraceCheckUtils]: 56: Hoare triple {19554#false} assume !false; {19554#false} is VALID [2018-11-23 10:49:24,507 INFO L134 CoverageAnalysis]: Checked inductivity of 0 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 0 trivial. 0 not checked. [2018-11-23 10:49:24,507 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-23 10:49:24,518 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 10:49:24,519 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [10] imperfect sequences [] total 10 [2018-11-23 10:49:24,519 INFO L78 Accepts]: Start accepts. Automaton has 10 states. Word has length 57 [2018-11-23 10:49:24,519 INFO L84 Accepts]: Finished accepts. word is accepted. [2018-11-23 10:49:24,519 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 10 states. [2018-11-23 10:49:24,659 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 57 edges. 57 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:49:24,659 INFO L459 AbstractCegarLoop]: Interpolant automaton has 10 states [2018-11-23 10:49:24,660 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 10 interpolants. [2018-11-23 10:49:24,660 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=17, Invalid=73, Unknown=0, NotChecked=0, Total=90 [2018-11-23 10:49:24,660 INFO L87 Difference]: Start difference. First operand 201 states and 260 transitions. Second operand 10 states. [2018-11-23 10:49:28,288 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:49:28,288 INFO L93 Difference]: Finished difference Result 213 states and 272 transitions. [2018-11-23 10:49:28,288 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 10 states. [2018-11-23 10:49:28,288 INFO L78 Accepts]: Start accepts. Automaton has 10 states. Word has length 57 [2018-11-23 10:49:28,288 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 10:49:28,289 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 10 states. [2018-11-23 10:49:28,290 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 10 states to 10 states and 244 transitions. [2018-11-23 10:49:28,290 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 10 states. [2018-11-23 10:49:28,291 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 10 states to 10 states and 244 transitions. [2018-11-23 10:49:28,291 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 10 states and 244 transitions. [2018-11-23 10:49:28,902 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 244 edges. 244 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:49:28,907 INFO L225 Difference]: With dead ends: 213 [2018-11-23 10:49:28,907 INFO L226 Difference]: Without dead ends: 199 [2018-11-23 10:49:28,908 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 57 GetRequests, 48 SyntacticMatches, 0 SemanticMatches, 9 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=21, Invalid=89, Unknown=0, NotChecked=0, Total=110 [2018-11-23 10:49:28,908 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 199 states. [2018-11-23 10:49:29,721 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 199 to 199. [2018-11-23 10:49:29,722 INFO L214 AbstractMinimizeNwa]: Start testing correctness of minimizeSevpa [2018-11-23 10:49:29,722 INFO L82 GeneralOperation]: Start isEquivalent. First operand 199 states. Second operand 199 states. [2018-11-23 10:49:29,722 INFO L74 IsIncluded]: Start isIncluded. First operand 199 states. Second operand 199 states. [2018-11-23 10:49:29,722 INFO L87 Difference]: Start difference. First operand 199 states. Second operand 199 states. [2018-11-23 10:49:29,726 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:49:29,726 INFO L93 Difference]: Finished difference Result 199 states and 256 transitions. [2018-11-23 10:49:29,726 INFO L276 IsEmpty]: Start isEmpty. Operand 199 states and 256 transitions. [2018-11-23 10:49:29,727 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:49:29,727 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:49:29,727 INFO L74 IsIncluded]: Start isIncluded. First operand 199 states. Second operand 199 states. [2018-11-23 10:49:29,727 INFO L87 Difference]: Start difference. First operand 199 states. Second operand 199 states. [2018-11-23 10:49:29,731 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:49:29,731 INFO L93 Difference]: Finished difference Result 199 states and 256 transitions. [2018-11-23 10:49:29,732 INFO L276 IsEmpty]: Start isEmpty. Operand 199 states and 256 transitions. [2018-11-23 10:49:29,732 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:49:29,732 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:49:29,732 INFO L88 GeneralOperation]: Finished isEquivalent. [2018-11-23 10:49:29,733 INFO L221 AbstractMinimizeNwa]: Finished testing correctness of minimizeSevpa [2018-11-23 10:49:29,733 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 199 states. [2018-11-23 10:49:29,737 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 199 states to 199 states and 256 transitions. [2018-11-23 10:49:29,737 INFO L78 Accepts]: Start accepts. Automaton has 199 states and 256 transitions. Word has length 57 [2018-11-23 10:49:29,738 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 10:49:29,738 INFO L480 AbstractCegarLoop]: Abstraction has 199 states and 256 transitions. [2018-11-23 10:49:29,738 INFO L481 AbstractCegarLoop]: Interpolant automaton has 10 states. [2018-11-23 10:49:29,738 INFO L276 IsEmpty]: Start isEmpty. Operand 199 states and 256 transitions. [2018-11-23 10:49:29,739 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 57 [2018-11-23 10:49:29,739 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 10:49:29,739 INFO L402 BasicCegarLoop]: trace histogram [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 10:49:29,739 INFO L423 AbstractCegarLoop]: === Iteration 15 === [errorFnErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 10:49:29,739 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 10:49:29,739 INFO L82 PathProgramCache]: Analyzing trace with hash 1127735086, now seen corresponding path program 1 times [2018-11-23 10:49:29,740 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 10:49:29,740 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/cvc4nyu Starting monitored process 16 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 16 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 10:49:29,762 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 10:49:29,849 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:49:29,874 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:49:29,876 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 10:49:30,093 INFO L256 TraceCheckUtils]: 0: Hoare triple {20684#true} call ULTIMATE.init(); {20684#true} is VALID [2018-11-23 10:49:30,093 INFO L273 TraceCheckUtils]: 1: Hoare triple {20684#true} ~KernelMode~0 := 0bv32;~Executive~0 := 0bv32;~DevicePowerState~0 := 0bv32;~s~0 := 0bv32;~UNLOADED~0 := 0bv32;~NP~0 := 0bv32;~DC~0 := 0bv32;~SKIP1~0 := 0bv32;~SKIP2~0 := 0bv32;~MPR1~0 := 0bv32;~MPR3~0 := 0bv32;~IPC~0 := 0bv32;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32;~myStatus~0 := 0bv32; {20684#true} is VALID [2018-11-23 10:49:30,093 INFO L273 TraceCheckUtils]: 2: Hoare triple {20684#true} assume true; {20684#true} is VALID [2018-11-23 10:49:30,093 INFO L268 TraceCheckUtils]: 3: Hoare quadruple {20684#true} {20684#true} #759#return; {20684#true} is VALID [2018-11-23 10:49:30,094 INFO L256 TraceCheckUtils]: 4: Hoare triple {20684#true} call #t~ret77 := main(); {20684#true} is VALID [2018-11-23 10:49:30,094 INFO L273 TraceCheckUtils]: 5: Hoare triple {20684#true} havoc ~status~1;~irp~0 := #t~nondet17;havoc #t~nondet17;havoc ~pirp~0;havoc ~pirp__IoStatus__Status~0;~irp_choice~0 := #t~nondet18;havoc #t~nondet18;~devobj~0 := #t~nondet19;havoc #t~nondet19;havoc ~__cil_tmp8~0;~KernelMode~0 := 0bv32;~Executive~0 := 0bv32;~DevicePowerState~0 := 1bv32;~s~0 := 0bv32;~UNLOADED~0 := 0bv32;~NP~0 := 0bv32;~DC~0 := 0bv32;~SKIP1~0 := 0bv32;~SKIP2~0 := 0bv32;~MPR1~0 := 0bv32;~MPR3~0 := 0bv32;~IPC~0 := 0bv32;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32;~myStatus~0 := 0bv32;~status~1 := 0bv32;~pirp~0 := ~irp~0; {20684#true} is VALID [2018-11-23 10:49:30,094 INFO L256 TraceCheckUtils]: 6: Hoare triple {20684#true} call _BLAST_init(); {20684#true} is VALID [2018-11-23 10:49:30,094 INFO L273 TraceCheckUtils]: 7: Hoare triple {20684#true} ~UNLOADED~0 := 0bv32;~NP~0 := 1bv32;~DC~0 := 2bv32;~SKIP1~0 := 3bv32;~SKIP2~0 := 4bv32;~MPR1~0 := 5bv32;~MPR3~0 := 6bv32;~IPC~0 := 7bv32;~s~0 := ~UNLOADED~0;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32; {20684#true} is VALID [2018-11-23 10:49:30,094 INFO L273 TraceCheckUtils]: 8: Hoare triple {20684#true} assume true; {20684#true} is VALID [2018-11-23 10:49:30,094 INFO L268 TraceCheckUtils]: 9: Hoare quadruple {20684#true} {20684#true} #717#return; {20684#true} is VALID [2018-11-23 10:49:30,095 INFO L273 TraceCheckUtils]: 10: Hoare triple {20684#true} assume ~bvsge32(~status~1, 0bv32);~s~0 := ~NP~0;~customIrp~0 := 0bv32;~setEventCalled~0 := ~customIrp~0;~lowerDriverReturn~0 := ~setEventCalled~0;~compRegistered~0 := ~lowerDriverReturn~0;~pended~0 := ~compRegistered~0;~pirp__IoStatus__Status~0 := 0bv32;~myStatus~0 := 0bv32; {20684#true} is VALID [2018-11-23 10:49:30,095 INFO L273 TraceCheckUtils]: 11: Hoare triple {20684#true} assume !(0bv32 == ~irp_choice~0); {20684#true} is VALID [2018-11-23 10:49:30,095 INFO L256 TraceCheckUtils]: 12: Hoare triple {20684#true} call stub_driver_init(); {20684#true} is VALID [2018-11-23 10:49:30,095 INFO L273 TraceCheckUtils]: 13: Hoare triple {20684#true} ~s~0 := ~NP~0;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32; {20684#true} is VALID [2018-11-23 10:49:30,096 INFO L273 TraceCheckUtils]: 14: Hoare triple {20684#true} assume true; {20684#true} is VALID [2018-11-23 10:49:30,096 INFO L268 TraceCheckUtils]: 15: Hoare quadruple {20684#true} {20684#true} #719#return; {20684#true} is VALID [2018-11-23 10:49:30,096 INFO L273 TraceCheckUtils]: 16: Hoare triple {20684#true} assume !~bvslt32(~status~1, 0bv32);havoc ~tmp_ndt_1~0;~tmp_ndt_1~0 := #t~nondet20;havoc #t~nondet20; {20684#true} is VALID [2018-11-23 10:49:30,096 INFO L273 TraceCheckUtils]: 17: Hoare triple {20684#true} assume 0bv32 == ~tmp_ndt_1~0; {20684#true} is VALID [2018-11-23 10:49:30,096 INFO L256 TraceCheckUtils]: 18: Hoare triple {20684#true} call #t~ret25 := KbFilter_CreateClose(~devobj~0, ~pirp~0); {20684#true} is VALID [2018-11-23 10:49:30,096 INFO L273 TraceCheckUtils]: 19: Hoare triple {20684#true} ~DeviceObject := #in~DeviceObject;~Irp := #in~Irp;~irpStack__MajorFunction~0 := #t~nondet37;havoc #t~nondet37;~devExt__UpperConnectData__ClassService~0 := #t~nondet38;havoc #t~nondet38;havoc ~Irp__IoStatus__Status~1;havoc ~status~2;havoc ~tmp~0;~status~2 := ~myStatus~0; {20684#true} is VALID [2018-11-23 10:49:30,097 INFO L273 TraceCheckUtils]: 20: Hoare triple {20684#true} assume 0bv32 == ~irpStack__MajorFunction~0; {20684#true} is VALID [2018-11-23 10:49:30,097 INFO L273 TraceCheckUtils]: 21: Hoare triple {20684#true} assume 0bv32 == ~devExt__UpperConnectData__ClassService~0;~status~2 := 3221225860bv32; {20684#true} is VALID [2018-11-23 10:49:30,097 INFO L273 TraceCheckUtils]: 22: Hoare triple {20684#true} ~Irp__IoStatus__Status~1 := ~status~2;~myStatus~0 := ~status~2; {20684#true} is VALID [2018-11-23 10:49:30,097 INFO L256 TraceCheckUtils]: 23: Hoare triple {20684#true} call #t~ret39 := KbFilter_DispatchPassThrough(~DeviceObject, ~Irp); {20684#true} is VALID [2018-11-23 10:49:30,097 INFO L273 TraceCheckUtils]: 24: Hoare triple {20684#true} ~DeviceObject := #in~DeviceObject;~Irp := #in~Irp;~Irp__Tail__Overlay__CurrentStackLocation~1 := #t~nondet40;havoc #t~nondet40;~Irp__CurrentLocation~1 := #t~nondet41;havoc #t~nondet41;~DeviceObject__DeviceExtension__TopOfStack~0 := #t~nondet42;havoc #t~nondet42;havoc ~irpStack~1;havoc ~tmp~1;~irpStack~1 := ~Irp__Tail__Overlay__CurrentStackLocation~1; {20684#true} is VALID [2018-11-23 10:49:30,097 INFO L273 TraceCheckUtils]: 25: Hoare triple {20684#true} assume ~s~0 == ~NP~0;~s~0 := ~SKIP1~0; {20684#true} is VALID [2018-11-23 10:49:30,097 INFO L273 TraceCheckUtils]: 26: Hoare triple {20684#true} #t~post43 := ~Irp__CurrentLocation~1;~Irp__CurrentLocation~1 := ~bvadd32(1bv32, #t~post43);havoc #t~post43;#t~post44 := ~Irp__Tail__Overlay__CurrentStackLocation~1;~Irp__Tail__Overlay__CurrentStackLocation~1 := ~bvadd32(1bv32, #t~post44);havoc #t~post44; {20684#true} is VALID [2018-11-23 10:49:30,097 INFO L256 TraceCheckUtils]: 27: Hoare triple {20684#true} call #t~ret45 := IofCallDriver(~DeviceObject__DeviceExtension__TopOfStack~0, ~Irp); {20684#true} is VALID [2018-11-23 10:49:30,097 INFO L273 TraceCheckUtils]: 28: Hoare triple {20684#true} ~DeviceObject := #in~DeviceObject;~Irp := #in~Irp;havoc ~returnVal2~0;havoc ~compRetStatus~0;~lcontext~0 := #t~nondet30;havoc #t~nondet30;havoc ~__cil_tmp7~0; {20684#true} is VALID [2018-11-23 10:49:30,098 INFO L273 TraceCheckUtils]: 29: Hoare triple {20684#true} assume !(0bv32 != ~compRegistered~0); {20684#true} is VALID [2018-11-23 10:49:30,098 INFO L273 TraceCheckUtils]: 30: Hoare triple {20684#true} havoc ~tmp_ndt_6~0;~tmp_ndt_6~0 := #t~nondet32;havoc #t~nondet32; {20684#true} is VALID [2018-11-23 10:49:30,098 INFO L273 TraceCheckUtils]: 31: Hoare triple {20684#true} assume 0bv32 == ~tmp_ndt_6~0; {20684#true} is VALID [2018-11-23 10:49:30,098 INFO L273 TraceCheckUtils]: 32: Hoare triple {20684#true} ~returnVal2~0 := 0bv32; {20684#true} is VALID [2018-11-23 10:49:30,098 INFO L273 TraceCheckUtils]: 33: Hoare triple {20684#true} assume !(~s~0 == ~NP~0); {20684#true} is VALID [2018-11-23 10:49:30,098 INFO L273 TraceCheckUtils]: 34: Hoare triple {20684#true} assume !(~s~0 == ~MPR1~0); {20684#true} is VALID [2018-11-23 10:49:30,099 INFO L273 TraceCheckUtils]: 35: Hoare triple {20684#true} assume ~s~0 == ~SKIP1~0;~s~0 := ~SKIP2~0;~lowerDriverReturn~0 := ~returnVal2~0; {20794#(= ~lowerDriverReturn~0 IofCallDriver_~returnVal2~0)} is VALID [2018-11-23 10:49:30,101 INFO L273 TraceCheckUtils]: 36: Hoare triple {20794#(= ~lowerDriverReturn~0 IofCallDriver_~returnVal2~0)} #res := ~returnVal2~0; {20798#(= |IofCallDriver_#res| ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:30,101 INFO L273 TraceCheckUtils]: 37: Hoare triple {20798#(= |IofCallDriver_#res| ~lowerDriverReturn~0)} assume true; {20798#(= |IofCallDriver_#res| ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:30,103 INFO L268 TraceCheckUtils]: 38: Hoare quadruple {20798#(= |IofCallDriver_#res| ~lowerDriverReturn~0)} {20684#true} #765#return; {20805#(= |KbFilter_DispatchPassThrough_#t~ret45| ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:30,104 INFO L273 TraceCheckUtils]: 39: Hoare triple {20805#(= |KbFilter_DispatchPassThrough_#t~ret45| ~lowerDriverReturn~0)} ~tmp~1 := #t~ret45;havoc #t~ret45;#res := ~tmp~1; {20809#(= ~lowerDriverReturn~0 |KbFilter_DispatchPassThrough_#res|)} is VALID [2018-11-23 10:49:30,104 INFO L273 TraceCheckUtils]: 40: Hoare triple {20809#(= ~lowerDriverReturn~0 |KbFilter_DispatchPassThrough_#res|)} assume true; {20809#(= ~lowerDriverReturn~0 |KbFilter_DispatchPassThrough_#res|)} is VALID [2018-11-23 10:49:30,106 INFO L268 TraceCheckUtils]: 41: Hoare quadruple {20809#(= ~lowerDriverReturn~0 |KbFilter_DispatchPassThrough_#res|)} {20684#true} #749#return; {20816#(= |KbFilter_CreateClose_#t~ret39| ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:30,107 INFO L273 TraceCheckUtils]: 42: Hoare triple {20816#(= |KbFilter_CreateClose_#t~ret39| ~lowerDriverReturn~0)} ~tmp~0 := #t~ret39;havoc #t~ret39;#res := ~tmp~0; {20820#(= ~lowerDriverReturn~0 |KbFilter_CreateClose_#res|)} is VALID [2018-11-23 10:49:30,107 INFO L273 TraceCheckUtils]: 43: Hoare triple {20820#(= ~lowerDriverReturn~0 |KbFilter_CreateClose_#res|)} assume true; {20820#(= ~lowerDriverReturn~0 |KbFilter_CreateClose_#res|)} is VALID [2018-11-23 10:49:30,108 INFO L268 TraceCheckUtils]: 44: Hoare quadruple {20820#(= ~lowerDriverReturn~0 |KbFilter_CreateClose_#res|)} {20684#true} #721#return; {20827#(= |main_#t~ret25| ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:30,110 INFO L273 TraceCheckUtils]: 45: Hoare triple {20827#(= |main_#t~ret25| ~lowerDriverReturn~0)} ~status~1 := #t~ret25;havoc #t~ret25; {20831#(= main_~status~1 ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:30,110 INFO L273 TraceCheckUtils]: 46: Hoare triple {20831#(= main_~status~1 ~lowerDriverReturn~0)} assume !(1bv32 == ~pended~0); {20831#(= main_~status~1 ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:30,112 INFO L273 TraceCheckUtils]: 47: Hoare triple {20831#(= main_~status~1 ~lowerDriverReturn~0)} assume !(1bv32 == ~pended~0); {20831#(= main_~status~1 ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:30,112 INFO L273 TraceCheckUtils]: 48: Hoare triple {20831#(= main_~status~1 ~lowerDriverReturn~0)} assume ~s~0 != ~UNLOADED~0; {20831#(= main_~status~1 ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:30,114 INFO L273 TraceCheckUtils]: 49: Hoare triple {20831#(= main_~status~1 ~lowerDriverReturn~0)} assume 4294967295bv32 != ~status~1; {20831#(= main_~status~1 ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:30,114 INFO L273 TraceCheckUtils]: 50: Hoare triple {20831#(= main_~status~1 ~lowerDriverReturn~0)} assume !(~s~0 != ~SKIP2~0); {20831#(= main_~status~1 ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:30,116 INFO L273 TraceCheckUtils]: 51: Hoare triple {20831#(= main_~status~1 ~lowerDriverReturn~0)} assume !(1bv32 == ~pended~0); {20831#(= main_~status~1 ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:30,116 INFO L273 TraceCheckUtils]: 52: Hoare triple {20831#(= main_~status~1 ~lowerDriverReturn~0)} assume !(~s~0 == ~DC~0); {20831#(= main_~status~1 ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:30,118 INFO L273 TraceCheckUtils]: 53: Hoare triple {20831#(= main_~status~1 ~lowerDriverReturn~0)} assume ~status~1 != ~lowerDriverReturn~0; {20685#false} is VALID [2018-11-23 10:49:30,118 INFO L256 TraceCheckUtils]: 54: Hoare triple {20685#false} call errorFn(); {20685#false} is VALID [2018-11-23 10:49:30,118 INFO L273 TraceCheckUtils]: 55: Hoare triple {20685#false} assume !false; {20685#false} is VALID [2018-11-23 10:49:30,120 INFO L134 CoverageAnalysis]: Checked inductivity of 0 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 0 trivial. 0 not checked. [2018-11-23 10:49:30,120 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-23 10:49:30,121 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 10:49:30,121 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [10] imperfect sequences [] total 10 [2018-11-23 10:49:30,122 INFO L78 Accepts]: Start accepts. Automaton has 10 states. Word has length 56 [2018-11-23 10:49:30,122 INFO L84 Accepts]: Finished accepts. word is accepted. [2018-11-23 10:49:30,123 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 10 states. [2018-11-23 10:49:30,204 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 56 edges. 56 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:49:30,205 INFO L459 AbstractCegarLoop]: Interpolant automaton has 10 states [2018-11-23 10:49:30,205 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 10 interpolants. [2018-11-23 10:49:30,205 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=17, Invalid=73, Unknown=0, NotChecked=0, Total=90 [2018-11-23 10:49:30,205 INFO L87 Difference]: Start difference. First operand 199 states and 256 transitions. Second operand 10 states. [2018-11-23 10:49:33,830 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:49:33,831 INFO L93 Difference]: Finished difference Result 211 states and 268 transitions. [2018-11-23 10:49:33,831 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 10 states. [2018-11-23 10:49:33,831 INFO L78 Accepts]: Start accepts. Automaton has 10 states. Word has length 56 [2018-11-23 10:49:33,831 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 10:49:33,831 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 10 states. [2018-11-23 10:49:33,832 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 10 states to 10 states and 240 transitions. [2018-11-23 10:49:33,833 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 10 states. [2018-11-23 10:49:33,834 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 10 states to 10 states and 240 transitions. [2018-11-23 10:49:33,834 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 10 states and 240 transitions. [2018-11-23 10:49:34,070 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 240 edges. 240 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:49:34,075 INFO L225 Difference]: With dead ends: 211 [2018-11-23 10:49:34,075 INFO L226 Difference]: Without dead ends: 187 [2018-11-23 10:49:34,075 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 56 GetRequests, 47 SyntacticMatches, 0 SemanticMatches, 9 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.1s TimeCoverageRelationStatistics Valid=21, Invalid=89, Unknown=0, NotChecked=0, Total=110 [2018-11-23 10:49:34,076 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 187 states. [2018-11-23 10:49:34,397 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 187 to 187. [2018-11-23 10:49:34,398 INFO L214 AbstractMinimizeNwa]: Start testing correctness of minimizeSevpa [2018-11-23 10:49:34,398 INFO L82 GeneralOperation]: Start isEquivalent. First operand 187 states. Second operand 187 states. [2018-11-23 10:49:34,398 INFO L74 IsIncluded]: Start isIncluded. First operand 187 states. Second operand 187 states. [2018-11-23 10:49:34,398 INFO L87 Difference]: Start difference. First operand 187 states. Second operand 187 states. [2018-11-23 10:49:34,403 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:49:34,403 INFO L93 Difference]: Finished difference Result 187 states and 239 transitions. [2018-11-23 10:49:34,403 INFO L276 IsEmpty]: Start isEmpty. Operand 187 states and 239 transitions. [2018-11-23 10:49:34,404 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:49:34,404 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:49:34,404 INFO L74 IsIncluded]: Start isIncluded. First operand 187 states. Second operand 187 states. [2018-11-23 10:49:34,404 INFO L87 Difference]: Start difference. First operand 187 states. Second operand 187 states. [2018-11-23 10:49:34,407 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:49:34,408 INFO L93 Difference]: Finished difference Result 187 states and 239 transitions. [2018-11-23 10:49:34,408 INFO L276 IsEmpty]: Start isEmpty. Operand 187 states and 239 transitions. [2018-11-23 10:49:34,408 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:49:34,408 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:49:34,408 INFO L88 GeneralOperation]: Finished isEquivalent. [2018-11-23 10:49:34,408 INFO L221 AbstractMinimizeNwa]: Finished testing correctness of minimizeSevpa [2018-11-23 10:49:34,409 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 187 states. [2018-11-23 10:49:34,411 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 187 states to 187 states and 239 transitions. [2018-11-23 10:49:34,412 INFO L78 Accepts]: Start accepts. Automaton has 187 states and 239 transitions. Word has length 56 [2018-11-23 10:49:34,412 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 10:49:34,412 INFO L480 AbstractCegarLoop]: Abstraction has 187 states and 239 transitions. [2018-11-23 10:49:34,412 INFO L481 AbstractCegarLoop]: Interpolant automaton has 10 states. [2018-11-23 10:49:34,412 INFO L276 IsEmpty]: Start isEmpty. Operand 187 states and 239 transitions. [2018-11-23 10:49:34,413 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 56 [2018-11-23 10:49:34,413 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 10:49:34,413 INFO L402 BasicCegarLoop]: trace histogram [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 10:49:34,413 INFO L423 AbstractCegarLoop]: === Iteration 16 === [errorFnErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 10:49:34,413 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 10:49:34,413 INFO L82 PathProgramCache]: Analyzing trace with hash -1554463583, now seen corresponding path program 1 times [2018-11-23 10:49:34,413 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 10:49:34,414 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/cvc4nyu Starting monitored process 17 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 17 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 10:49:34,430 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 10:49:34,514 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:49:34,550 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:49:34,551 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 10:49:34,713 INFO L256 TraceCheckUtils]: 0: Hoare triple {21768#true} call ULTIMATE.init(); {21768#true} is VALID [2018-11-23 10:49:34,713 INFO L273 TraceCheckUtils]: 1: Hoare triple {21768#true} ~KernelMode~0 := 0bv32;~Executive~0 := 0bv32;~DevicePowerState~0 := 0bv32;~s~0 := 0bv32;~UNLOADED~0 := 0bv32;~NP~0 := 0bv32;~DC~0 := 0bv32;~SKIP1~0 := 0bv32;~SKIP2~0 := 0bv32;~MPR1~0 := 0bv32;~MPR3~0 := 0bv32;~IPC~0 := 0bv32;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32;~myStatus~0 := 0bv32; {21768#true} is VALID [2018-11-23 10:49:34,713 INFO L273 TraceCheckUtils]: 2: Hoare triple {21768#true} assume true; {21768#true} is VALID [2018-11-23 10:49:34,714 INFO L268 TraceCheckUtils]: 3: Hoare quadruple {21768#true} {21768#true} #759#return; {21768#true} is VALID [2018-11-23 10:49:34,714 INFO L256 TraceCheckUtils]: 4: Hoare triple {21768#true} call #t~ret77 := main(); {21768#true} is VALID [2018-11-23 10:49:34,714 INFO L273 TraceCheckUtils]: 5: Hoare triple {21768#true} havoc ~status~1;~irp~0 := #t~nondet17;havoc #t~nondet17;havoc ~pirp~0;havoc ~pirp__IoStatus__Status~0;~irp_choice~0 := #t~nondet18;havoc #t~nondet18;~devobj~0 := #t~nondet19;havoc #t~nondet19;havoc ~__cil_tmp8~0;~KernelMode~0 := 0bv32;~Executive~0 := 0bv32;~DevicePowerState~0 := 1bv32;~s~0 := 0bv32;~UNLOADED~0 := 0bv32;~NP~0 := 0bv32;~DC~0 := 0bv32;~SKIP1~0 := 0bv32;~SKIP2~0 := 0bv32;~MPR1~0 := 0bv32;~MPR3~0 := 0bv32;~IPC~0 := 0bv32;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32;~myStatus~0 := 0bv32;~status~1 := 0bv32;~pirp~0 := ~irp~0; {21768#true} is VALID [2018-11-23 10:49:34,714 INFO L256 TraceCheckUtils]: 6: Hoare triple {21768#true} call _BLAST_init(); {21768#true} is VALID [2018-11-23 10:49:34,714 INFO L273 TraceCheckUtils]: 7: Hoare triple {21768#true} ~UNLOADED~0 := 0bv32;~NP~0 := 1bv32;~DC~0 := 2bv32;~SKIP1~0 := 3bv32;~SKIP2~0 := 4bv32;~MPR1~0 := 5bv32;~MPR3~0 := 6bv32;~IPC~0 := 7bv32;~s~0 := ~UNLOADED~0;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32; {21768#true} is VALID [2018-11-23 10:49:34,715 INFO L273 TraceCheckUtils]: 8: Hoare triple {21768#true} assume true; {21768#true} is VALID [2018-11-23 10:49:34,715 INFO L268 TraceCheckUtils]: 9: Hoare quadruple {21768#true} {21768#true} #717#return; {21768#true} is VALID [2018-11-23 10:49:34,715 INFO L273 TraceCheckUtils]: 10: Hoare triple {21768#true} assume ~bvsge32(~status~1, 0bv32);~s~0 := ~NP~0;~customIrp~0 := 0bv32;~setEventCalled~0 := ~customIrp~0;~lowerDriverReturn~0 := ~setEventCalled~0;~compRegistered~0 := ~lowerDriverReturn~0;~pended~0 := ~compRegistered~0;~pirp__IoStatus__Status~0 := 0bv32;~myStatus~0 := 0bv32; {21768#true} is VALID [2018-11-23 10:49:34,715 INFO L273 TraceCheckUtils]: 11: Hoare triple {21768#true} assume !(0bv32 == ~irp_choice~0); {21768#true} is VALID [2018-11-23 10:49:34,715 INFO L256 TraceCheckUtils]: 12: Hoare triple {21768#true} call stub_driver_init(); {21768#true} is VALID [2018-11-23 10:49:34,715 INFO L273 TraceCheckUtils]: 13: Hoare triple {21768#true} ~s~0 := ~NP~0;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32; {21768#true} is VALID [2018-11-23 10:49:34,716 INFO L273 TraceCheckUtils]: 14: Hoare triple {21768#true} assume true; {21768#true} is VALID [2018-11-23 10:49:34,716 INFO L268 TraceCheckUtils]: 15: Hoare quadruple {21768#true} {21768#true} #719#return; {21768#true} is VALID [2018-11-23 10:49:34,716 INFO L273 TraceCheckUtils]: 16: Hoare triple {21768#true} assume !~bvslt32(~status~1, 0bv32);havoc ~tmp_ndt_1~0;~tmp_ndt_1~0 := #t~nondet20;havoc #t~nondet20; {21768#true} is VALID [2018-11-23 10:49:34,716 INFO L273 TraceCheckUtils]: 17: Hoare triple {21768#true} assume !(0bv32 == ~tmp_ndt_1~0);havoc ~tmp_ndt_2~0;~tmp_ndt_2~0 := #t~nondet21;havoc #t~nondet21; {21768#true} is VALID [2018-11-23 10:49:34,716 INFO L273 TraceCheckUtils]: 18: Hoare triple {21768#true} assume !(1bv32 == ~tmp_ndt_2~0);havoc ~tmp_ndt_3~0;~tmp_ndt_3~0 := #t~nondet22;havoc #t~nondet22; {21768#true} is VALID [2018-11-23 10:49:34,716 INFO L273 TraceCheckUtils]: 19: Hoare triple {21768#true} assume 3bv32 == ~tmp_ndt_3~0; {21768#true} is VALID [2018-11-23 10:49:34,717 INFO L256 TraceCheckUtils]: 20: Hoare triple {21768#true} call #t~ret27 := KbFilter_PnP(~devobj~0, ~pirp~0); {21768#true} is VALID [2018-11-23 10:49:34,717 INFO L273 TraceCheckUtils]: 21: Hoare triple {21768#true} ~DeviceObject := #in~DeviceObject;~Irp := #in~Irp;havoc ~devExt~0;havoc ~irpStack~0;havoc ~status~0;~event~0 := #t~nondet0;havoc #t~nondet0;~DeviceObject__DeviceExtension~0 := #t~nondet1;havoc #t~nondet1;~Irp__Tail__Overlay__CurrentStackLocation~0 := #t~nondet2;havoc #t~nondet2;~irpStack__MinorFunction~0 := #t~nondet3;havoc #t~nondet3;~devExt__TopOfStack~0 := #t~nondet4;havoc #t~nondet4;havoc ~devExt__Started~0;havoc ~devExt__Removed~0;havoc ~devExt__SurpriseRemoved~0;havoc ~Irp__IoStatus__Status~0;havoc ~Irp__IoStatus__Information~0;~Irp__CurrentLocation~0 := #t~nondet5;havoc #t~nondet5;havoc ~irpSp~0;havoc ~nextIrpSp~0;havoc ~nextIrpSp__Control~0;havoc ~irpSp___0~0;havoc ~irpSp__Context~0;havoc ~irpSp__Control~0;havoc ~__cil_tmp23~0;~status~0 := 0bv32;~devExt~0 := ~DeviceObject__DeviceExtension~0;~irpStack~0 := ~Irp__Tail__Overlay__CurrentStackLocation~0; {21768#true} is VALID [2018-11-23 10:49:34,717 INFO L273 TraceCheckUtils]: 22: Hoare triple {21768#true} assume !(0bv32 == ~irpStack__MinorFunction~0); {21768#true} is VALID [2018-11-23 10:49:34,717 INFO L273 TraceCheckUtils]: 23: Hoare triple {21768#true} assume !(23bv32 == ~irpStack__MinorFunction~0); {21768#true} is VALID [2018-11-23 10:49:34,717 INFO L273 TraceCheckUtils]: 24: Hoare triple {21768#true} assume 2bv32 == ~irpStack__MinorFunction~0; {21768#true} is VALID [2018-11-23 10:49:34,718 INFO L273 TraceCheckUtils]: 25: Hoare triple {21768#true} ~devExt__Removed~0 := 1bv32; {21768#true} is VALID [2018-11-23 10:49:34,718 INFO L273 TraceCheckUtils]: 26: Hoare triple {21768#true} assume ~s~0 == ~NP~0;~s~0 := ~SKIP1~0; {21768#true} is VALID [2018-11-23 10:49:34,718 INFO L273 TraceCheckUtils]: 27: Hoare triple {21768#true} #t~post11 := ~Irp__CurrentLocation~0;~Irp__CurrentLocation~0 := ~bvadd32(1bv32, #t~post11);havoc #t~post11;#t~post12 := ~Irp__Tail__Overlay__CurrentStackLocation~0;~Irp__Tail__Overlay__CurrentStackLocation~0 := ~bvadd32(1bv32, #t~post12);havoc #t~post12; {21768#true} is VALID [2018-11-23 10:49:34,718 INFO L256 TraceCheckUtils]: 28: Hoare triple {21768#true} call #t~ret13 := IofCallDriver(~devExt__TopOfStack~0, ~Irp); {21768#true} is VALID [2018-11-23 10:49:34,718 INFO L273 TraceCheckUtils]: 29: Hoare triple {21768#true} ~DeviceObject := #in~DeviceObject;~Irp := #in~Irp;havoc ~returnVal2~0;havoc ~compRetStatus~0;~lcontext~0 := #t~nondet30;havoc #t~nondet30;havoc ~__cil_tmp7~0; {21768#true} is VALID [2018-11-23 10:49:34,718 INFO L273 TraceCheckUtils]: 30: Hoare triple {21768#true} assume !(0bv32 != ~compRegistered~0); {21768#true} is VALID [2018-11-23 10:49:34,719 INFO L273 TraceCheckUtils]: 31: Hoare triple {21768#true} havoc ~tmp_ndt_6~0;~tmp_ndt_6~0 := #t~nondet32;havoc #t~nondet32; {21768#true} is VALID [2018-11-23 10:49:34,719 INFO L273 TraceCheckUtils]: 32: Hoare triple {21768#true} assume 0bv32 == ~tmp_ndt_6~0; {21768#true} is VALID [2018-11-23 10:49:34,734 INFO L273 TraceCheckUtils]: 33: Hoare triple {21768#true} ~returnVal2~0 := 0bv32; {21872#(= (_ bv0 32) IofCallDriver_~returnVal2~0)} is VALID [2018-11-23 10:49:34,736 INFO L273 TraceCheckUtils]: 34: Hoare triple {21872#(= (_ bv0 32) IofCallDriver_~returnVal2~0)} assume !(~s~0 == ~NP~0); {21872#(= (_ bv0 32) IofCallDriver_~returnVal2~0)} is VALID [2018-11-23 10:49:34,736 INFO L273 TraceCheckUtils]: 35: Hoare triple {21872#(= (_ bv0 32) IofCallDriver_~returnVal2~0)} assume !(~s~0 == ~MPR1~0); {21872#(= (_ bv0 32) IofCallDriver_~returnVal2~0)} is VALID [2018-11-23 10:49:34,737 INFO L273 TraceCheckUtils]: 36: Hoare triple {21872#(= (_ bv0 32) IofCallDriver_~returnVal2~0)} assume ~s~0 == ~SKIP1~0;~s~0 := ~SKIP2~0;~lowerDriverReturn~0 := ~returnVal2~0; {21882#(= ~lowerDriverReturn~0 (_ bv0 32))} is VALID [2018-11-23 10:49:34,737 INFO L273 TraceCheckUtils]: 37: Hoare triple {21882#(= ~lowerDriverReturn~0 (_ bv0 32))} #res := ~returnVal2~0; {21882#(= ~lowerDriverReturn~0 (_ bv0 32))} is VALID [2018-11-23 10:49:34,737 INFO L273 TraceCheckUtils]: 38: Hoare triple {21882#(= ~lowerDriverReturn~0 (_ bv0 32))} assume true; {21882#(= ~lowerDriverReturn~0 (_ bv0 32))} is VALID [2018-11-23 10:49:34,738 INFO L268 TraceCheckUtils]: 39: Hoare quadruple {21882#(= ~lowerDriverReturn~0 (_ bv0 32))} {21768#true} #783#return; {21882#(= ~lowerDriverReturn~0 (_ bv0 32))} is VALID [2018-11-23 10:49:34,738 INFO L273 TraceCheckUtils]: 40: Hoare triple {21882#(= ~lowerDriverReturn~0 (_ bv0 32))} havoc #t~ret13;~status~0 := 0bv32; {21895#(and (= ~lowerDriverReturn~0 (_ bv0 32)) (= KbFilter_PnP_~status~0 (_ bv0 32)))} is VALID [2018-11-23 10:49:34,739 INFO L273 TraceCheckUtils]: 41: Hoare triple {21895#(and (= ~lowerDriverReturn~0 (_ bv0 32)) (= KbFilter_PnP_~status~0 (_ bv0 32)))} #res := ~status~0; {21899#(and (= |KbFilter_PnP_#res| (_ bv0 32)) (= ~lowerDriverReturn~0 (_ bv0 32)))} is VALID [2018-11-23 10:49:34,739 INFO L273 TraceCheckUtils]: 42: Hoare triple {21899#(and (= |KbFilter_PnP_#res| (_ bv0 32)) (= ~lowerDriverReturn~0 (_ bv0 32)))} assume true; {21899#(and (= |KbFilter_PnP_#res| (_ bv0 32)) (= ~lowerDriverReturn~0 (_ bv0 32)))} is VALID [2018-11-23 10:49:34,740 INFO L268 TraceCheckUtils]: 43: Hoare quadruple {21899#(and (= |KbFilter_PnP_#res| (_ bv0 32)) (= ~lowerDriverReturn~0 (_ bv0 32)))} {21768#true} #725#return; {21906#(and (= |main_#t~ret27| (_ bv0 32)) (= ~lowerDriverReturn~0 (_ bv0 32)))} is VALID [2018-11-23 10:49:34,740 INFO L273 TraceCheckUtils]: 44: Hoare triple {21906#(and (= |main_#t~ret27| (_ bv0 32)) (= ~lowerDriverReturn~0 (_ bv0 32)))} ~status~1 := #t~ret27;havoc #t~ret27; {21910#(and (= ~lowerDriverReturn~0 (_ bv0 32)) (= main_~status~1 (_ bv0 32)))} is VALID [2018-11-23 10:49:34,741 INFO L273 TraceCheckUtils]: 45: Hoare triple {21910#(and (= ~lowerDriverReturn~0 (_ bv0 32)) (= main_~status~1 (_ bv0 32)))} assume !(1bv32 == ~pended~0); {21910#(and (= ~lowerDriverReturn~0 (_ bv0 32)) (= main_~status~1 (_ bv0 32)))} is VALID [2018-11-23 10:49:34,742 INFO L273 TraceCheckUtils]: 46: Hoare triple {21910#(and (= ~lowerDriverReturn~0 (_ bv0 32)) (= main_~status~1 (_ bv0 32)))} assume !(1bv32 == ~pended~0); {21910#(and (= ~lowerDriverReturn~0 (_ bv0 32)) (= main_~status~1 (_ bv0 32)))} is VALID [2018-11-23 10:49:34,742 INFO L273 TraceCheckUtils]: 47: Hoare triple {21910#(and (= ~lowerDriverReturn~0 (_ bv0 32)) (= main_~status~1 (_ bv0 32)))} assume ~s~0 != ~UNLOADED~0; {21910#(and (= ~lowerDriverReturn~0 (_ bv0 32)) (= main_~status~1 (_ bv0 32)))} is VALID [2018-11-23 10:49:34,743 INFO L273 TraceCheckUtils]: 48: Hoare triple {21910#(and (= ~lowerDriverReturn~0 (_ bv0 32)) (= main_~status~1 (_ bv0 32)))} assume 4294967295bv32 != ~status~1; {21910#(and (= ~lowerDriverReturn~0 (_ bv0 32)) (= main_~status~1 (_ bv0 32)))} is VALID [2018-11-23 10:49:34,744 INFO L273 TraceCheckUtils]: 49: Hoare triple {21910#(and (= ~lowerDriverReturn~0 (_ bv0 32)) (= main_~status~1 (_ bv0 32)))} assume !(~s~0 != ~SKIP2~0); {21910#(and (= ~lowerDriverReturn~0 (_ bv0 32)) (= main_~status~1 (_ bv0 32)))} is VALID [2018-11-23 10:49:34,744 INFO L273 TraceCheckUtils]: 50: Hoare triple {21910#(and (= ~lowerDriverReturn~0 (_ bv0 32)) (= main_~status~1 (_ bv0 32)))} assume !(1bv32 == ~pended~0); {21910#(and (= ~lowerDriverReturn~0 (_ bv0 32)) (= main_~status~1 (_ bv0 32)))} is VALID [2018-11-23 10:49:34,745 INFO L273 TraceCheckUtils]: 51: Hoare triple {21910#(and (= ~lowerDriverReturn~0 (_ bv0 32)) (= main_~status~1 (_ bv0 32)))} assume !(~s~0 == ~DC~0); {21910#(and (= ~lowerDriverReturn~0 (_ bv0 32)) (= main_~status~1 (_ bv0 32)))} is VALID [2018-11-23 10:49:34,746 INFO L273 TraceCheckUtils]: 52: Hoare triple {21910#(and (= ~lowerDriverReturn~0 (_ bv0 32)) (= main_~status~1 (_ bv0 32)))} assume ~status~1 != ~lowerDriverReturn~0; {21769#false} is VALID [2018-11-23 10:49:34,746 INFO L256 TraceCheckUtils]: 53: Hoare triple {21769#false} call errorFn(); {21769#false} is VALID [2018-11-23 10:49:34,746 INFO L273 TraceCheckUtils]: 54: Hoare triple {21769#false} assume !false; {21769#false} is VALID [2018-11-23 10:49:34,749 INFO L134 CoverageAnalysis]: Checked inductivity of 0 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 0 trivial. 0 not checked. [2018-11-23 10:49:34,750 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-23 10:49:34,751 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 10:49:34,752 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [8] imperfect sequences [] total 8 [2018-11-23 10:49:34,752 INFO L78 Accepts]: Start accepts. Automaton has 8 states. Word has length 55 [2018-11-23 10:49:34,752 INFO L84 Accepts]: Finished accepts. word is accepted. [2018-11-23 10:49:34,752 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 8 states. [2018-11-23 10:49:34,812 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 55 edges. 55 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:49:34,813 INFO L459 AbstractCegarLoop]: Interpolant automaton has 8 states [2018-11-23 10:49:34,813 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 8 interpolants. [2018-11-23 10:49:34,813 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=17, Invalid=39, Unknown=0, NotChecked=0, Total=56 [2018-11-23 10:49:34,813 INFO L87 Difference]: Start difference. First operand 187 states and 239 transitions. Second operand 8 states. [2018-11-23 10:49:37,580 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:49:37,580 INFO L93 Difference]: Finished difference Result 330 states and 403 transitions. [2018-11-23 10:49:37,580 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 8 states. [2018-11-23 10:49:37,580 INFO L78 Accepts]: Start accepts. Automaton has 8 states. Word has length 55 [2018-11-23 10:49:37,581 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 10:49:37,581 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 8 states. [2018-11-23 10:49:37,584 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 8 states to 8 states and 352 transitions. [2018-11-23 10:49:37,584 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 8 states. [2018-11-23 10:49:37,588 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 8 states to 8 states and 352 transitions. [2018-11-23 10:49:37,588 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 8 states and 352 transitions. [2018-11-23 10:49:38,152 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 352 edges. 352 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:49:38,167 INFO L225 Difference]: With dead ends: 330 [2018-11-23 10:49:38,167 INFO L226 Difference]: Without dead ends: 260 [2018-11-23 10:49:38,168 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 57 GetRequests, 48 SyntacticMatches, 0 SemanticMatches, 9 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 3 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=31, Invalid=79, Unknown=0, NotChecked=0, Total=110 [2018-11-23 10:49:38,169 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 260 states. [2018-11-23 10:49:38,602 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 260 to 197. [2018-11-23 10:49:38,602 INFO L214 AbstractMinimizeNwa]: Start testing correctness of minimizeSevpa [2018-11-23 10:49:38,603 INFO L82 GeneralOperation]: Start isEquivalent. First operand 260 states. Second operand 197 states. [2018-11-23 10:49:38,603 INFO L74 IsIncluded]: Start isIncluded. First operand 260 states. Second operand 197 states. [2018-11-23 10:49:38,603 INFO L87 Difference]: Start difference. First operand 260 states. Second operand 197 states. [2018-11-23 10:49:38,613 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:49:38,613 INFO L93 Difference]: Finished difference Result 260 states and 321 transitions. [2018-11-23 10:49:38,613 INFO L276 IsEmpty]: Start isEmpty. Operand 260 states and 321 transitions. [2018-11-23 10:49:38,614 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:49:38,614 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:49:38,614 INFO L74 IsIncluded]: Start isIncluded. First operand 197 states. Second operand 260 states. [2018-11-23 10:49:38,614 INFO L87 Difference]: Start difference. First operand 197 states. Second operand 260 states. [2018-11-23 10:49:38,624 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:49:38,624 INFO L93 Difference]: Finished difference Result 260 states and 321 transitions. [2018-11-23 10:49:38,624 INFO L276 IsEmpty]: Start isEmpty. Operand 260 states and 321 transitions. [2018-11-23 10:49:38,625 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:49:38,625 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:49:38,625 INFO L88 GeneralOperation]: Finished isEquivalent. [2018-11-23 10:49:38,625 INFO L221 AbstractMinimizeNwa]: Finished testing correctness of minimizeSevpa [2018-11-23 10:49:38,625 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 197 states. [2018-11-23 10:49:38,632 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 197 states to 197 states and 252 transitions. [2018-11-23 10:49:38,632 INFO L78 Accepts]: Start accepts. Automaton has 197 states and 252 transitions. Word has length 55 [2018-11-23 10:49:38,632 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 10:49:38,632 INFO L480 AbstractCegarLoop]: Abstraction has 197 states and 252 transitions. [2018-11-23 10:49:38,632 INFO L481 AbstractCegarLoop]: Interpolant automaton has 8 states. [2018-11-23 10:49:38,632 INFO L276 IsEmpty]: Start isEmpty. Operand 197 states and 252 transitions. [2018-11-23 10:49:38,633 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 56 [2018-11-23 10:49:38,633 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 10:49:38,633 INFO L402 BasicCegarLoop]: trace histogram [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 10:49:38,634 INFO L423 AbstractCegarLoop]: === Iteration 17 === [errorFnErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 10:49:38,634 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 10:49:38,634 INFO L82 PathProgramCache]: Analyzing trace with hash -725184292, now seen corresponding path program 1 times [2018-11-23 10:49:38,634 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 10:49:38,634 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/cvc4nyu Starting monitored process 18 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 18 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 10:49:38,661 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 10:49:38,745 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:49:38,777 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 10:49:38,778 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 10:49:38,978 INFO L256 TraceCheckUtils]: 0: Hoare triple {23161#true} call ULTIMATE.init(); {23161#true} is VALID [2018-11-23 10:49:38,978 INFO L273 TraceCheckUtils]: 1: Hoare triple {23161#true} ~KernelMode~0 := 0bv32;~Executive~0 := 0bv32;~DevicePowerState~0 := 0bv32;~s~0 := 0bv32;~UNLOADED~0 := 0bv32;~NP~0 := 0bv32;~DC~0 := 0bv32;~SKIP1~0 := 0bv32;~SKIP2~0 := 0bv32;~MPR1~0 := 0bv32;~MPR3~0 := 0bv32;~IPC~0 := 0bv32;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32;~myStatus~0 := 0bv32; {23161#true} is VALID [2018-11-23 10:49:38,979 INFO L273 TraceCheckUtils]: 2: Hoare triple {23161#true} assume true; {23161#true} is VALID [2018-11-23 10:49:38,979 INFO L268 TraceCheckUtils]: 3: Hoare quadruple {23161#true} {23161#true} #759#return; {23161#true} is VALID [2018-11-23 10:49:38,979 INFO L256 TraceCheckUtils]: 4: Hoare triple {23161#true} call #t~ret77 := main(); {23161#true} is VALID [2018-11-23 10:49:38,979 INFO L273 TraceCheckUtils]: 5: Hoare triple {23161#true} havoc ~status~1;~irp~0 := #t~nondet17;havoc #t~nondet17;havoc ~pirp~0;havoc ~pirp__IoStatus__Status~0;~irp_choice~0 := #t~nondet18;havoc #t~nondet18;~devobj~0 := #t~nondet19;havoc #t~nondet19;havoc ~__cil_tmp8~0;~KernelMode~0 := 0bv32;~Executive~0 := 0bv32;~DevicePowerState~0 := 1bv32;~s~0 := 0bv32;~UNLOADED~0 := 0bv32;~NP~0 := 0bv32;~DC~0 := 0bv32;~SKIP1~0 := 0bv32;~SKIP2~0 := 0bv32;~MPR1~0 := 0bv32;~MPR3~0 := 0bv32;~IPC~0 := 0bv32;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32;~myStatus~0 := 0bv32;~status~1 := 0bv32;~pirp~0 := ~irp~0; {23161#true} is VALID [2018-11-23 10:49:38,979 INFO L256 TraceCheckUtils]: 6: Hoare triple {23161#true} call _BLAST_init(); {23161#true} is VALID [2018-11-23 10:49:38,980 INFO L273 TraceCheckUtils]: 7: Hoare triple {23161#true} ~UNLOADED~0 := 0bv32;~NP~0 := 1bv32;~DC~0 := 2bv32;~SKIP1~0 := 3bv32;~SKIP2~0 := 4bv32;~MPR1~0 := 5bv32;~MPR3~0 := 6bv32;~IPC~0 := 7bv32;~s~0 := ~UNLOADED~0;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32; {23161#true} is VALID [2018-11-23 10:49:38,980 INFO L273 TraceCheckUtils]: 8: Hoare triple {23161#true} assume true; {23161#true} is VALID [2018-11-23 10:49:38,980 INFO L268 TraceCheckUtils]: 9: Hoare quadruple {23161#true} {23161#true} #717#return; {23161#true} is VALID [2018-11-23 10:49:38,980 INFO L273 TraceCheckUtils]: 10: Hoare triple {23161#true} assume ~bvsge32(~status~1, 0bv32);~s~0 := ~NP~0;~customIrp~0 := 0bv32;~setEventCalled~0 := ~customIrp~0;~lowerDriverReturn~0 := ~setEventCalled~0;~compRegistered~0 := ~lowerDriverReturn~0;~pended~0 := ~compRegistered~0;~pirp__IoStatus__Status~0 := 0bv32;~myStatus~0 := 0bv32; {23161#true} is VALID [2018-11-23 10:49:38,980 INFO L273 TraceCheckUtils]: 11: Hoare triple {23161#true} assume !(0bv32 == ~irp_choice~0); {23161#true} is VALID [2018-11-23 10:49:38,981 INFO L256 TraceCheckUtils]: 12: Hoare triple {23161#true} call stub_driver_init(); {23161#true} is VALID [2018-11-23 10:49:38,981 INFO L273 TraceCheckUtils]: 13: Hoare triple {23161#true} ~s~0 := ~NP~0;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32; {23161#true} is VALID [2018-11-23 10:49:38,981 INFO L273 TraceCheckUtils]: 14: Hoare triple {23161#true} assume true; {23161#true} is VALID [2018-11-23 10:49:38,981 INFO L268 TraceCheckUtils]: 15: Hoare quadruple {23161#true} {23161#true} #719#return; {23161#true} is VALID [2018-11-23 10:49:38,981 INFO L273 TraceCheckUtils]: 16: Hoare triple {23161#true} assume !~bvslt32(~status~1, 0bv32);havoc ~tmp_ndt_1~0;~tmp_ndt_1~0 := #t~nondet20;havoc #t~nondet20; {23161#true} is VALID [2018-11-23 10:49:38,982 INFO L273 TraceCheckUtils]: 17: Hoare triple {23161#true} assume !(0bv32 == ~tmp_ndt_1~0);havoc ~tmp_ndt_2~0;~tmp_ndt_2~0 := #t~nondet21;havoc #t~nondet21; {23161#true} is VALID [2018-11-23 10:49:38,982 INFO L273 TraceCheckUtils]: 18: Hoare triple {23161#true} assume !(1bv32 == ~tmp_ndt_2~0);havoc ~tmp_ndt_3~0;~tmp_ndt_3~0 := #t~nondet22;havoc #t~nondet22; {23161#true} is VALID [2018-11-23 10:49:38,982 INFO L273 TraceCheckUtils]: 19: Hoare triple {23161#true} assume 3bv32 == ~tmp_ndt_3~0; {23161#true} is VALID [2018-11-23 10:49:38,982 INFO L256 TraceCheckUtils]: 20: Hoare triple {23161#true} call #t~ret27 := KbFilter_PnP(~devobj~0, ~pirp~0); {23161#true} is VALID [2018-11-23 10:49:38,982 INFO L273 TraceCheckUtils]: 21: Hoare triple {23161#true} ~DeviceObject := #in~DeviceObject;~Irp := #in~Irp;havoc ~devExt~0;havoc ~irpStack~0;havoc ~status~0;~event~0 := #t~nondet0;havoc #t~nondet0;~DeviceObject__DeviceExtension~0 := #t~nondet1;havoc #t~nondet1;~Irp__Tail__Overlay__CurrentStackLocation~0 := #t~nondet2;havoc #t~nondet2;~irpStack__MinorFunction~0 := #t~nondet3;havoc #t~nondet3;~devExt__TopOfStack~0 := #t~nondet4;havoc #t~nondet4;havoc ~devExt__Started~0;havoc ~devExt__Removed~0;havoc ~devExt__SurpriseRemoved~0;havoc ~Irp__IoStatus__Status~0;havoc ~Irp__IoStatus__Information~0;~Irp__CurrentLocation~0 := #t~nondet5;havoc #t~nondet5;havoc ~irpSp~0;havoc ~nextIrpSp~0;havoc ~nextIrpSp__Control~0;havoc ~irpSp___0~0;havoc ~irpSp__Context~0;havoc ~irpSp__Control~0;havoc ~__cil_tmp23~0;~status~0 := 0bv32;~devExt~0 := ~DeviceObject__DeviceExtension~0;~irpStack~0 := ~Irp__Tail__Overlay__CurrentStackLocation~0; {23161#true} is VALID [2018-11-23 10:49:38,982 INFO L273 TraceCheckUtils]: 22: Hoare triple {23161#true} assume !(0bv32 == ~irpStack__MinorFunction~0); {23161#true} is VALID [2018-11-23 10:49:38,983 INFO L273 TraceCheckUtils]: 23: Hoare triple {23161#true} assume !(23bv32 == ~irpStack__MinorFunction~0); {23161#true} is VALID [2018-11-23 10:49:38,983 INFO L273 TraceCheckUtils]: 24: Hoare triple {23161#true} assume !(2bv32 == ~irpStack__MinorFunction~0); {23161#true} is VALID [2018-11-23 10:49:38,983 INFO L273 TraceCheckUtils]: 25: Hoare triple {23161#true} assume 1bv32 == ~irpStack__MinorFunction~0; {23161#true} is VALID [2018-11-23 10:49:38,983 INFO L273 TraceCheckUtils]: 26: Hoare triple {23161#true} assume ~s~0 == ~NP~0;~s~0 := ~SKIP1~0; {23161#true} is VALID [2018-11-23 10:49:38,983 INFO L273 TraceCheckUtils]: 27: Hoare triple {23161#true} #t~post14 := ~Irp__CurrentLocation~0;~Irp__CurrentLocation~0 := ~bvadd32(1bv32, #t~post14);havoc #t~post14;#t~post15 := ~Irp__Tail__Overlay__CurrentStackLocation~0;~Irp__Tail__Overlay__CurrentStackLocation~0 := ~bvadd32(1bv32, #t~post15);havoc #t~post15; {23161#true} is VALID [2018-11-23 10:49:38,983 INFO L256 TraceCheckUtils]: 28: Hoare triple {23161#true} call #t~ret16 := IofCallDriver(~devExt__TopOfStack~0, ~Irp); {23161#true} is VALID [2018-11-23 10:49:38,983 INFO L273 TraceCheckUtils]: 29: Hoare triple {23161#true} ~DeviceObject := #in~DeviceObject;~Irp := #in~Irp;havoc ~returnVal2~0;havoc ~compRetStatus~0;~lcontext~0 := #t~nondet30;havoc #t~nondet30;havoc ~__cil_tmp7~0; {23161#true} is VALID [2018-11-23 10:49:38,983 INFO L273 TraceCheckUtils]: 30: Hoare triple {23161#true} assume !(0bv32 != ~compRegistered~0); {23161#true} is VALID [2018-11-23 10:49:38,984 INFO L273 TraceCheckUtils]: 31: Hoare triple {23161#true} havoc ~tmp_ndt_6~0;~tmp_ndt_6~0 := #t~nondet32;havoc #t~nondet32; {23161#true} is VALID [2018-11-23 10:49:38,984 INFO L273 TraceCheckUtils]: 32: Hoare triple {23161#true} assume 0bv32 == ~tmp_ndt_6~0; {23161#true} is VALID [2018-11-23 10:49:38,984 INFO L273 TraceCheckUtils]: 33: Hoare triple {23161#true} ~returnVal2~0 := 0bv32; {23161#true} is VALID [2018-11-23 10:49:38,984 INFO L273 TraceCheckUtils]: 34: Hoare triple {23161#true} assume !(~s~0 == ~NP~0); {23161#true} is VALID [2018-11-23 10:49:38,984 INFO L273 TraceCheckUtils]: 35: Hoare triple {23161#true} assume !(~s~0 == ~MPR1~0); {23161#true} is VALID [2018-11-23 10:49:38,984 INFO L273 TraceCheckUtils]: 36: Hoare triple {23161#true} assume ~s~0 == ~SKIP1~0;~s~0 := ~SKIP2~0;~lowerDriverReturn~0 := ~returnVal2~0; {23274#(= ~lowerDriverReturn~0 IofCallDriver_~returnVal2~0)} is VALID [2018-11-23 10:49:39,001 INFO L273 TraceCheckUtils]: 37: Hoare triple {23274#(= ~lowerDriverReturn~0 IofCallDriver_~returnVal2~0)} #res := ~returnVal2~0; {23278#(= |IofCallDriver_#res| ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:39,014 INFO L273 TraceCheckUtils]: 38: Hoare triple {23278#(= |IofCallDriver_#res| ~lowerDriverReturn~0)} assume true; {23278#(= |IofCallDriver_#res| ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:39,020 INFO L268 TraceCheckUtils]: 39: Hoare quadruple {23278#(= |IofCallDriver_#res| ~lowerDriverReturn~0)} {23161#true} #787#return; {23285#(= ~lowerDriverReturn~0 |KbFilter_PnP_#t~ret16|)} is VALID [2018-11-23 10:49:39,021 INFO L273 TraceCheckUtils]: 40: Hoare triple {23285#(= ~lowerDriverReturn~0 |KbFilter_PnP_#t~ret16|)} ~status~0 := #t~ret16;havoc #t~ret16; {23289#(= KbFilter_PnP_~status~0 ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:39,021 INFO L273 TraceCheckUtils]: 41: Hoare triple {23289#(= KbFilter_PnP_~status~0 ~lowerDriverReturn~0)} #res := ~status~0; {23293#(= |KbFilter_PnP_#res| ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:39,021 INFO L273 TraceCheckUtils]: 42: Hoare triple {23293#(= |KbFilter_PnP_#res| ~lowerDriverReturn~0)} assume true; {23293#(= |KbFilter_PnP_#res| ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:39,022 INFO L268 TraceCheckUtils]: 43: Hoare quadruple {23293#(= |KbFilter_PnP_#res| ~lowerDriverReturn~0)} {23161#true} #725#return; {23300#(= |main_#t~ret27| ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:39,023 INFO L273 TraceCheckUtils]: 44: Hoare triple {23300#(= |main_#t~ret27| ~lowerDriverReturn~0)} ~status~1 := #t~ret27;havoc #t~ret27; {23304#(= main_~status~1 ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:39,040 INFO L273 TraceCheckUtils]: 45: Hoare triple {23304#(= main_~status~1 ~lowerDriverReturn~0)} assume !(1bv32 == ~pended~0); {23304#(= main_~status~1 ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:39,048 INFO L273 TraceCheckUtils]: 46: Hoare triple {23304#(= main_~status~1 ~lowerDriverReturn~0)} assume !(1bv32 == ~pended~0); {23304#(= main_~status~1 ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:39,064 INFO L273 TraceCheckUtils]: 47: Hoare triple {23304#(= main_~status~1 ~lowerDriverReturn~0)} assume ~s~0 != ~UNLOADED~0; {23304#(= main_~status~1 ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:39,073 INFO L273 TraceCheckUtils]: 48: Hoare triple {23304#(= main_~status~1 ~lowerDriverReturn~0)} assume 4294967295bv32 != ~status~1; {23304#(= main_~status~1 ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:39,086 INFO L273 TraceCheckUtils]: 49: Hoare triple {23304#(= main_~status~1 ~lowerDriverReturn~0)} assume !(~s~0 != ~SKIP2~0); {23304#(= main_~status~1 ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:39,095 INFO L273 TraceCheckUtils]: 50: Hoare triple {23304#(= main_~status~1 ~lowerDriverReturn~0)} assume !(1bv32 == ~pended~0); {23304#(= main_~status~1 ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:39,096 INFO L273 TraceCheckUtils]: 51: Hoare triple {23304#(= main_~status~1 ~lowerDriverReturn~0)} assume !(~s~0 == ~DC~0); {23304#(= main_~status~1 ~lowerDriverReturn~0)} is VALID [2018-11-23 10:49:39,099 INFO L273 TraceCheckUtils]: 52: Hoare triple {23304#(= main_~status~1 ~lowerDriverReturn~0)} assume ~status~1 != ~lowerDriverReturn~0; {23162#false} is VALID [2018-11-23 10:49:39,099 INFO L256 TraceCheckUtils]: 53: Hoare triple {23162#false} call errorFn(); {23162#false} is VALID [2018-11-23 10:49:39,099 INFO L273 TraceCheckUtils]: 54: Hoare triple {23162#false} assume !false; {23162#false} is VALID [2018-11-23 10:49:39,101 INFO L134 CoverageAnalysis]: Checked inductivity of 0 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 0 trivial. 0 not checked. [2018-11-23 10:49:39,101 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-23 10:49:39,103 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 10:49:39,103 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [9] imperfect sequences [] total 9 [2018-11-23 10:49:39,103 INFO L78 Accepts]: Start accepts. Automaton has 9 states. Word has length 55 [2018-11-23 10:49:39,104 INFO L84 Accepts]: Finished accepts. word is accepted. [2018-11-23 10:49:39,104 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 9 states. [2018-11-23 10:49:39,163 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 55 edges. 55 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:49:39,163 INFO L459 AbstractCegarLoop]: Interpolant automaton has 9 states [2018-11-23 10:49:39,163 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 9 interpolants. [2018-11-23 10:49:39,163 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=15, Invalid=57, Unknown=0, NotChecked=0, Total=72 [2018-11-23 10:49:39,164 INFO L87 Difference]: Start difference. First operand 197 states and 252 transitions. Second operand 9 states. [2018-11-23 10:49:42,096 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:49:42,096 INFO L93 Difference]: Finished difference Result 213 states and 268 transitions. [2018-11-23 10:49:42,096 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 9 states. [2018-11-23 10:49:42,096 INFO L78 Accepts]: Start accepts. Automaton has 9 states. Word has length 55 [2018-11-23 10:49:42,097 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 10:49:42,097 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 9 states. [2018-11-23 10:49:42,099 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 9 states to 9 states and 227 transitions. [2018-11-23 10:49:42,099 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 9 states. [2018-11-23 10:49:42,101 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 9 states to 9 states and 227 transitions. [2018-11-23 10:49:42,101 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 9 states and 227 transitions. [2018-11-23 10:49:42,371 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 227 edges. 227 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 10:49:42,375 INFO L225 Difference]: With dead ends: 213 [2018-11-23 10:49:42,376 INFO L226 Difference]: Without dead ends: 175 [2018-11-23 10:49:42,376 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 56 GetRequests, 47 SyntacticMatches, 0 SemanticMatches, 9 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 1 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=23, Invalid=87, Unknown=0, NotChecked=0, Total=110 [2018-11-23 10:49:42,377 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 175 states. [2018-11-23 10:49:42,767 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 175 to 175. [2018-11-23 10:49:42,768 INFO L214 AbstractMinimizeNwa]: Start testing correctness of minimizeSevpa [2018-11-23 10:49:42,768 INFO L82 GeneralOperation]: Start isEquivalent. First operand 175 states. Second operand 175 states. [2018-11-23 10:49:42,768 INFO L74 IsIncluded]: Start isIncluded. First operand 175 states. Second operand 175 states. [2018-11-23 10:49:42,768 INFO L87 Difference]: Start difference. First operand 175 states. Second operand 175 states. [2018-11-23 10:49:42,772 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:49:42,772 INFO L93 Difference]: Finished difference Result 175 states and 209 transitions. [2018-11-23 10:49:42,772 INFO L276 IsEmpty]: Start isEmpty. Operand 175 states and 209 transitions. [2018-11-23 10:49:42,772 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:49:42,772 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:49:42,772 INFO L74 IsIncluded]: Start isIncluded. First operand 175 states. Second operand 175 states. [2018-11-23 10:49:42,772 INFO L87 Difference]: Start difference. First operand 175 states. Second operand 175 states. [2018-11-23 10:49:42,776 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 10:49:42,776 INFO L93 Difference]: Finished difference Result 175 states and 209 transitions. [2018-11-23 10:49:42,776 INFO L276 IsEmpty]: Start isEmpty. Operand 175 states and 209 transitions. [2018-11-23 10:49:42,776 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 10:49:42,776 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 10:49:42,777 INFO L88 GeneralOperation]: Finished isEquivalent. [2018-11-23 10:49:42,777 INFO L221 AbstractMinimizeNwa]: Finished testing correctness of minimizeSevpa [2018-11-23 10:49:42,777 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 175 states. [2018-11-23 10:49:42,780 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 175 states to 175 states and 209 transitions. [2018-11-23 10:49:42,780 INFO L78 Accepts]: Start accepts. Automaton has 175 states and 209 transitions. Word has length 55 [2018-11-23 10:49:42,780 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 10:49:42,780 INFO L480 AbstractCegarLoop]: Abstraction has 175 states and 209 transitions. [2018-11-23 10:49:42,780 INFO L481 AbstractCegarLoop]: Interpolant automaton has 9 states. [2018-11-23 10:49:42,780 INFO L276 IsEmpty]: Start isEmpty. Operand 175 states and 209 transitions. [2018-11-23 10:49:42,781 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 57 [2018-11-23 10:49:42,781 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 10:49:42,781 INFO L402 BasicCegarLoop]: trace histogram [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 10:49:42,781 INFO L423 AbstractCegarLoop]: === Iteration 18 === [errorFnErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 10:49:42,781 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 10:49:42,782 INFO L82 PathProgramCache]: Analyzing trace with hash -1656625880, now seen corresponding path program 1 times [2018-11-23 10:49:42,782 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 10:49:42,782 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/cvc4nyu Starting monitored process 19 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 19 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 10:49:42,811 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 10:49:42,988 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is sat [2018-11-23 10:49:43,190 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is sat [2018-11-23 10:49:43,434 INFO L469 BasicCegarLoop]: Counterexample might be feasible ----- class de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder.RCFGBacktranslator [?] CALL call ULTIMATE.init(); VAL [|old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv0 32), ~DevicePowerState~0=(_ bv0 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv0 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv0 32), ~MPR3~0=(_ bv0 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv0 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv0 32), ~SKIP2~0=(_ bv0 32), ~s~0=(_ bv0 32), ~UNLOADED~0=(_ bv0 32)] [?] ~KernelMode~0 := 0bv32;~Executive~0 := 0bv32;~DevicePowerState~0 := 0bv32;~s~0 := 0bv32;~UNLOADED~0 := 0bv32;~NP~0 := 0bv32;~DC~0 := 0bv32;~SKIP1~0 := 0bv32;~SKIP2~0 := 0bv32;~MPR1~0 := 0bv32;~MPR3~0 := 0bv32;~IPC~0 := 0bv32;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32;~myStatus~0 := 0bv32; VAL [|old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv0 32), ~DevicePowerState~0=(_ bv0 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv0 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv0 32), ~MPR3~0=(_ bv0 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv0 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv0 32), ~SKIP2~0=(_ bv0 32), ~s~0=(_ bv0 32), ~UNLOADED~0=(_ bv0 32)] [?] assume true; VAL [|old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv0 32), ~DevicePowerState~0=(_ bv0 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv0 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv0 32), ~MPR3~0=(_ bv0 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv0 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv0 32), ~SKIP2~0=(_ bv0 32), ~s~0=(_ bv0 32), ~UNLOADED~0=(_ bv0 32)] [?] RET #759#return; VAL [~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv0 32), ~DevicePowerState~0=(_ bv0 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv0 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv0 32), ~MPR3~0=(_ bv0 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv0 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv0 32), ~SKIP2~0=(_ bv0 32), ~s~0=(_ bv0 32), ~UNLOADED~0=(_ bv0 32)] [?] CALL call #t~ret77 := main(); VAL [|old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv0 32), ~DevicePowerState~0=(_ bv0 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv0 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv0 32), ~MPR3~0=(_ bv0 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv0 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv0 32), ~SKIP2~0=(_ bv0 32), ~s~0=(_ bv0 32), ~UNLOADED~0=(_ bv0 32)] [?] havoc ~status~1;~irp~0 := #t~nondet17;havoc #t~nondet17;havoc ~pirp~0;havoc ~pirp__IoStatus__Status~0;~irp_choice~0 := #t~nondet18;havoc #t~nondet18;~devobj~0 := #t~nondet19;havoc #t~nondet19;havoc ~__cil_tmp8~0;~KernelMode~0 := 0bv32;~Executive~0 := 0bv32;~DevicePowerState~0 := 1bv32;~s~0 := 0bv32;~UNLOADED~0 := 0bv32;~NP~0 := 0bv32;~DC~0 := 0bv32;~SKIP1~0 := 0bv32;~SKIP2~0 := 0bv32;~MPR1~0 := 0bv32;~MPR3~0 := 0bv32;~IPC~0 := 0bv32;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32;~myStatus~0 := 0bv32;~status~1 := 0bv32;~pirp~0 := ~irp~0; VAL [main_~devobj~0=(_ bv0 32), main_~irp_choice~0=(_ bv1 32), main_~irp~0=(_ bv0 32), main_~pirp~0=(_ bv0 32), main_~status~1=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv0 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv0 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv0 32), ~MPR3~0=(_ bv0 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv0 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv0 32), ~SKIP2~0=(_ bv0 32), ~s~0=(_ bv0 32), ~UNLOADED~0=(_ bv0 32)] [?] CALL call _BLAST_init(); VAL [|old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv0 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv0 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv0 32), ~MPR3~0=(_ bv0 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv0 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv0 32), ~SKIP2~0=(_ bv0 32), ~s~0=(_ bv0 32), ~UNLOADED~0=(_ bv0 32)] [?] ~UNLOADED~0 := 0bv32;~NP~0 := 1bv32;~DC~0 := 2bv32;~SKIP1~0 := 3bv32;~SKIP2~0 := 4bv32;~MPR1~0 := 5bv32;~MPR3~0 := 6bv32;~IPC~0 := 7bv32;~s~0 := ~UNLOADED~0;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32; VAL [|old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv0 32), ~UNLOADED~0=(_ bv0 32)] [?] assume true; VAL [|old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv0 32), ~UNLOADED~0=(_ bv0 32)] [?] RET #717#return; VAL [main_~devobj~0=(_ bv0 32), main_~irp_choice~0=(_ bv1 32), main_~irp~0=(_ bv0 32), main_~pirp~0=(_ bv0 32), main_~status~1=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv0 32), ~UNLOADED~0=(_ bv0 32)] [?] assume ~bvsge32(~status~1, 0bv32);~s~0 := ~NP~0;~customIrp~0 := 0bv32;~setEventCalled~0 := ~customIrp~0;~lowerDriverReturn~0 := ~setEventCalled~0;~compRegistered~0 := ~lowerDriverReturn~0;~pended~0 := ~compRegistered~0;~pirp__IoStatus__Status~0 := 0bv32;~myStatus~0 := 0bv32; VAL [main_~devobj~0=(_ bv0 32), main_~irp_choice~0=(_ bv1 32), main_~irp~0=(_ bv0 32), main_~pirp__IoStatus__Status~0=(_ bv0 32), main_~pirp~0=(_ bv0 32), main_~status~1=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv1 32), ~UNLOADED~0=(_ bv0 32)] [?] assume !(0bv32 == ~irp_choice~0); VAL [main_~devobj~0=(_ bv0 32), main_~irp_choice~0=(_ bv1 32), main_~irp~0=(_ bv0 32), main_~pirp__IoStatus__Status~0=(_ bv0 32), main_~pirp~0=(_ bv0 32), main_~status~1=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv1 32), ~UNLOADED~0=(_ bv0 32)] [?] CALL call stub_driver_init(); VAL [|old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv1 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv1 32), ~UNLOADED~0=(_ bv0 32)] [?] ~s~0 := ~NP~0;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32; VAL [|old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv1 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv1 32), ~UNLOADED~0=(_ bv0 32)] [?] assume true; VAL [|old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv1 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv1 32), ~UNLOADED~0=(_ bv0 32)] [?] RET #719#return; VAL [main_~devobj~0=(_ bv0 32), main_~irp_choice~0=(_ bv1 32), main_~irp~0=(_ bv0 32), main_~pirp__IoStatus__Status~0=(_ bv0 32), main_~pirp~0=(_ bv0 32), main_~status~1=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv1 32), ~UNLOADED~0=(_ bv0 32)] [?] assume !~bvslt32(~status~1, 0bv32);havoc ~tmp_ndt_1~0;~tmp_ndt_1~0 := #t~nondet20;havoc #t~nondet20; VAL [main_~devobj~0=(_ bv0 32), main_~irp_choice~0=(_ bv1 32), main_~irp~0=(_ bv0 32), main_~pirp__IoStatus__Status~0=(_ bv0 32), main_~pirp~0=(_ bv0 32), main_~status~1=(_ bv0 32), main_~tmp_ndt_1~0=(_ bv1 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv1 32), ~UNLOADED~0=(_ bv0 32)] [?] assume !(0bv32 == ~tmp_ndt_1~0);havoc ~tmp_ndt_2~0;~tmp_ndt_2~0 := #t~nondet21;havoc #t~nondet21; VAL [main_~devobj~0=(_ bv0 32), main_~irp_choice~0=(_ bv1 32), main_~irp~0=(_ bv0 32), main_~pirp__IoStatus__Status~0=(_ bv0 32), main_~pirp~0=(_ bv0 32), main_~status~1=(_ bv0 32), main_~tmp_ndt_1~0=(_ bv1 32), main_~tmp_ndt_2~0=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv1 32), ~UNLOADED~0=(_ bv0 32)] [?] assume !(1bv32 == ~tmp_ndt_2~0);havoc ~tmp_ndt_3~0;~tmp_ndt_3~0 := #t~nondet22;havoc #t~nondet22; VAL [main_~devobj~0=(_ bv0 32), main_~irp_choice~0=(_ bv1 32), main_~irp~0=(_ bv0 32), main_~pirp__IoStatus__Status~0=(_ bv0 32), main_~pirp~0=(_ bv0 32), main_~status~1=(_ bv0 32), main_~tmp_ndt_1~0=(_ bv1 32), main_~tmp_ndt_2~0=(_ bv0 32), main_~tmp_ndt_3~0=(_ bv3 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv1 32), ~UNLOADED~0=(_ bv0 32)] [?] assume 3bv32 == ~tmp_ndt_3~0; VAL [main_~devobj~0=(_ bv0 32), main_~irp_choice~0=(_ bv1 32), main_~irp~0=(_ bv0 32), main_~pirp__IoStatus__Status~0=(_ bv0 32), main_~pirp~0=(_ bv0 32), main_~status~1=(_ bv0 32), main_~tmp_ndt_1~0=(_ bv1 32), main_~tmp_ndt_2~0=(_ bv0 32), main_~tmp_ndt_3~0=(_ bv3 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv1 32), ~UNLOADED~0=(_ bv0 32)] [?] CALL call #t~ret27 := KbFilter_PnP(~devobj~0, ~pirp~0); VAL [|KbFilter_PnP_#in~DeviceObject|=(_ bv0 32), |KbFilter_PnP_#in~Irp|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv1 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv1 32), ~UNLOADED~0=(_ bv0 32)] [?] ~DeviceObject := #in~DeviceObject;~Irp := #in~Irp;havoc ~devExt~0;havoc ~irpStack~0;havoc ~status~0;~event~0 := #t~nondet0;havoc #t~nondet0;~DeviceObject__DeviceExtension~0 := #t~nondet1;havoc #t~nondet1;~Irp__Tail__Overlay__CurrentStackLocation~0 := #t~nondet2;havoc #t~nondet2;~irpStack__MinorFunction~0 := #t~nondet3;havoc #t~nondet3;~devExt__TopOfStack~0 := #t~nondet4;havoc #t~nondet4;havoc ~devExt__Started~0;havoc ~devExt__Removed~0;havoc ~devExt__SurpriseRemoved~0;havoc ~Irp__IoStatus__Status~0;havoc ~Irp__IoStatus__Information~0;~Irp__CurrentLocation~0 := #t~nondet5;havoc #t~nondet5;havoc ~irpSp~0;havoc ~nextIrpSp~0;havoc ~nextIrpSp__Control~0;havoc ~irpSp___0~0;havoc ~irpSp__Context~0;havoc ~irpSp__Control~0;havoc ~__cil_tmp23~0;~status~0 := 0bv32;~devExt~0 := ~DeviceObject__DeviceExtension~0;~irpStack~0 := ~Irp__Tail__Overlay__CurrentStackLocation~0; VAL [KbFilter_PnP_~devExt__TopOfStack~0=(_ bv0 32), KbFilter_PnP_~devExt~0=(_ bv0 32), KbFilter_PnP_~DeviceObject=(_ bv0 32), KbFilter_PnP_~DeviceObject__DeviceExtension~0=(_ bv0 32), KbFilter_PnP_~event~0=(_ bv0 32), KbFilter_PnP_~Irp=(_ bv0 32), KbFilter_PnP_~Irp__CurrentLocation~0=(_ bv2147483647 32), KbFilter_PnP_~Irp__Tail__Overlay__CurrentStackLocation~0=(_ bv2147483647 32), KbFilter_PnP_~irpStack__MinorFunction~0=(_ bv2 32), KbFilter_PnP_~irpStack~0=(_ bv2147483647 32), KbFilter_PnP_~status~0=(_ bv0 32), |KbFilter_PnP_#in~DeviceObject|=(_ bv0 32), |KbFilter_PnP_#in~Irp|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv1 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv1 32), ~UNLOADED~0=(_ bv0 32)] [?] assume !(0bv32 == ~irpStack__MinorFunction~0); VAL [KbFilter_PnP_~devExt__TopOfStack~0=(_ bv0 32), KbFilter_PnP_~devExt~0=(_ bv0 32), KbFilter_PnP_~DeviceObject=(_ bv0 32), KbFilter_PnP_~DeviceObject__DeviceExtension~0=(_ bv0 32), KbFilter_PnP_~event~0=(_ bv0 32), KbFilter_PnP_~Irp=(_ bv0 32), KbFilter_PnP_~Irp__CurrentLocation~0=(_ bv2147483647 32), KbFilter_PnP_~Irp__Tail__Overlay__CurrentStackLocation~0=(_ bv2147483647 32), KbFilter_PnP_~irpStack__MinorFunction~0=(_ bv2 32), KbFilter_PnP_~irpStack~0=(_ bv2147483647 32), KbFilter_PnP_~status~0=(_ bv0 32), |KbFilter_PnP_#in~DeviceObject|=(_ bv0 32), |KbFilter_PnP_#in~Irp|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv1 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv1 32), ~UNLOADED~0=(_ bv0 32)] [?] assume !(23bv32 == ~irpStack__MinorFunction~0); VAL [KbFilter_PnP_~devExt__TopOfStack~0=(_ bv0 32), KbFilter_PnP_~devExt~0=(_ bv0 32), KbFilter_PnP_~DeviceObject=(_ bv0 32), KbFilter_PnP_~DeviceObject__DeviceExtension~0=(_ bv0 32), KbFilter_PnP_~event~0=(_ bv0 32), KbFilter_PnP_~Irp=(_ bv0 32), KbFilter_PnP_~Irp__CurrentLocation~0=(_ bv2147483647 32), KbFilter_PnP_~Irp__Tail__Overlay__CurrentStackLocation~0=(_ bv2147483647 32), KbFilter_PnP_~irpStack__MinorFunction~0=(_ bv2 32), KbFilter_PnP_~irpStack~0=(_ bv2147483647 32), KbFilter_PnP_~status~0=(_ bv0 32), |KbFilter_PnP_#in~DeviceObject|=(_ bv0 32), |KbFilter_PnP_#in~Irp|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv1 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv1 32), ~UNLOADED~0=(_ bv0 32)] [?] assume 2bv32 == ~irpStack__MinorFunction~0; VAL [KbFilter_PnP_~devExt__TopOfStack~0=(_ bv0 32), KbFilter_PnP_~devExt~0=(_ bv0 32), KbFilter_PnP_~DeviceObject=(_ bv0 32), KbFilter_PnP_~DeviceObject__DeviceExtension~0=(_ bv0 32), KbFilter_PnP_~event~0=(_ bv0 32), KbFilter_PnP_~Irp=(_ bv0 32), KbFilter_PnP_~Irp__CurrentLocation~0=(_ bv2147483647 32), KbFilter_PnP_~Irp__Tail__Overlay__CurrentStackLocation~0=(_ bv2147483647 32), KbFilter_PnP_~irpStack__MinorFunction~0=(_ bv2 32), KbFilter_PnP_~irpStack~0=(_ bv2147483647 32), KbFilter_PnP_~status~0=(_ bv0 32), |KbFilter_PnP_#in~DeviceObject|=(_ bv0 32), |KbFilter_PnP_#in~Irp|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv1 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv1 32), ~UNLOADED~0=(_ bv0 32)] [?] ~devExt__Removed~0 := 1bv32; VAL [KbFilter_PnP_~devExt__Removed~0=(_ bv1 32), KbFilter_PnP_~devExt__TopOfStack~0=(_ bv0 32), KbFilter_PnP_~devExt~0=(_ bv0 32), KbFilter_PnP_~DeviceObject=(_ bv0 32), KbFilter_PnP_~DeviceObject__DeviceExtension~0=(_ bv0 32), KbFilter_PnP_~event~0=(_ bv0 32), KbFilter_PnP_~Irp=(_ bv0 32), KbFilter_PnP_~Irp__CurrentLocation~0=(_ bv2147483647 32), KbFilter_PnP_~Irp__Tail__Overlay__CurrentStackLocation~0=(_ bv2147483647 32), KbFilter_PnP_~irpStack__MinorFunction~0=(_ bv2 32), KbFilter_PnP_~irpStack~0=(_ bv2147483647 32), KbFilter_PnP_~status~0=(_ bv0 32), |KbFilter_PnP_#in~DeviceObject|=(_ bv0 32), |KbFilter_PnP_#in~Irp|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv1 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv1 32), ~UNLOADED~0=(_ bv0 32)] [?] assume ~s~0 == ~NP~0;~s~0 := ~SKIP1~0; VAL [KbFilter_PnP_~devExt__Removed~0=(_ bv1 32), KbFilter_PnP_~devExt__TopOfStack~0=(_ bv0 32), KbFilter_PnP_~devExt~0=(_ bv0 32), KbFilter_PnP_~DeviceObject=(_ bv0 32), KbFilter_PnP_~DeviceObject__DeviceExtension~0=(_ bv0 32), KbFilter_PnP_~event~0=(_ bv0 32), KbFilter_PnP_~Irp=(_ bv0 32), KbFilter_PnP_~Irp__CurrentLocation~0=(_ bv2147483647 32), KbFilter_PnP_~Irp__Tail__Overlay__CurrentStackLocation~0=(_ bv2147483647 32), KbFilter_PnP_~irpStack__MinorFunction~0=(_ bv2 32), KbFilter_PnP_~irpStack~0=(_ bv2147483647 32), KbFilter_PnP_~status~0=(_ bv0 32), |KbFilter_PnP_#in~DeviceObject|=(_ bv0 32), |KbFilter_PnP_#in~Irp|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv1 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv3 32), ~UNLOADED~0=(_ bv0 32)] [?] #t~post11 := ~Irp__CurrentLocation~0;~Irp__CurrentLocation~0 := ~bvadd32(1bv32, #t~post11);havoc #t~post11;#t~post12 := ~Irp__Tail__Overlay__CurrentStackLocation~0;~Irp__Tail__Overlay__CurrentStackLocation~0 := ~bvadd32(1bv32, #t~post12);havoc #t~post12; VAL [KbFilter_PnP_~devExt__Removed~0=(_ bv1 32), KbFilter_PnP_~devExt__TopOfStack~0=(_ bv0 32), KbFilter_PnP_~devExt~0=(_ bv0 32), KbFilter_PnP_~DeviceObject=(_ bv0 32), KbFilter_PnP_~DeviceObject__DeviceExtension~0=(_ bv0 32), KbFilter_PnP_~event~0=(_ bv0 32), KbFilter_PnP_~Irp=(_ bv0 32), KbFilter_PnP_~Irp__CurrentLocation~0=(_ bv2147483648 32), KbFilter_PnP_~Irp__Tail__Overlay__CurrentStackLocation~0=(_ bv2147483648 32), KbFilter_PnP_~irpStack__MinorFunction~0=(_ bv2 32), KbFilter_PnP_~irpStack~0=(_ bv2147483647 32), KbFilter_PnP_~status~0=(_ bv0 32), |KbFilter_PnP_#in~DeviceObject|=(_ bv0 32), |KbFilter_PnP_#in~Irp|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv1 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv3 32), ~UNLOADED~0=(_ bv0 32)] [?] CALL call #t~ret13 := IofCallDriver(~devExt__TopOfStack~0, ~Irp); VAL [|IofCallDriver_#in~DeviceObject|=(_ bv0 32), |IofCallDriver_#in~Irp|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv3 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv3 32), ~UNLOADED~0=(_ bv0 32)] [?] ~DeviceObject := #in~DeviceObject;~Irp := #in~Irp;havoc ~returnVal2~0;havoc ~compRetStatus~0;~lcontext~0 := #t~nondet30;havoc #t~nondet30;havoc ~__cil_tmp7~0; VAL [IofCallDriver_~DeviceObject=(_ bv0 32), IofCallDriver_~Irp=(_ bv0 32), IofCallDriver_~lcontext~0=(_ bv0 32), |IofCallDriver_#in~DeviceObject|=(_ bv0 32), |IofCallDriver_#in~Irp|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv3 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv3 32), ~UNLOADED~0=(_ bv0 32)] [?] assume !(0bv32 != ~compRegistered~0); VAL [IofCallDriver_~DeviceObject=(_ bv0 32), IofCallDriver_~Irp=(_ bv0 32), IofCallDriver_~lcontext~0=(_ bv0 32), |IofCallDriver_#in~DeviceObject|=(_ bv0 32), |IofCallDriver_#in~Irp|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv3 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv3 32), ~UNLOADED~0=(_ bv0 32)] [?] havoc ~tmp_ndt_6~0;~tmp_ndt_6~0 := #t~nondet32;havoc #t~nondet32; VAL [IofCallDriver_~DeviceObject=(_ bv0 32), IofCallDriver_~Irp=(_ bv0 32), IofCallDriver_~lcontext~0=(_ bv0 32), IofCallDriver_~tmp_ndt_6~0=(_ bv1 32), |IofCallDriver_#in~DeviceObject|=(_ bv0 32), |IofCallDriver_#in~Irp|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv3 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv3 32), ~UNLOADED~0=(_ bv0 32)] [?] assume !(0bv32 == ~tmp_ndt_6~0);havoc ~tmp_ndt_7~0;~tmp_ndt_7~0 := #t~nondet33;havoc #t~nondet33; VAL [IofCallDriver_~DeviceObject=(_ bv0 32), IofCallDriver_~Irp=(_ bv0 32), IofCallDriver_~lcontext~0=(_ bv0 32), IofCallDriver_~tmp_ndt_6~0=(_ bv1 32), IofCallDriver_~tmp_ndt_7~0=(_ bv1 32), |IofCallDriver_#in~DeviceObject|=(_ bv0 32), |IofCallDriver_#in~Irp|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv3 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv3 32), ~UNLOADED~0=(_ bv0 32)] [?] assume 1bv32 == ~tmp_ndt_7~0; VAL [IofCallDriver_~DeviceObject=(_ bv0 32), IofCallDriver_~Irp=(_ bv0 32), IofCallDriver_~lcontext~0=(_ bv0 32), IofCallDriver_~tmp_ndt_6~0=(_ bv1 32), IofCallDriver_~tmp_ndt_7~0=(_ bv1 32), |IofCallDriver_#in~DeviceObject|=(_ bv0 32), |IofCallDriver_#in~Irp|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv3 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv3 32), ~UNLOADED~0=(_ bv0 32)] [?] ~returnVal2~0 := 3221225473bv32; VAL [IofCallDriver_~DeviceObject=(_ bv0 32), IofCallDriver_~Irp=(_ bv0 32), IofCallDriver_~lcontext~0=(_ bv0 32), IofCallDriver_~returnVal2~0=(_ bv3221225473 32), IofCallDriver_~tmp_ndt_6~0=(_ bv1 32), IofCallDriver_~tmp_ndt_7~0=(_ bv1 32), |IofCallDriver_#in~DeviceObject|=(_ bv0 32), |IofCallDriver_#in~Irp|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv3 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv3 32), ~UNLOADED~0=(_ bv0 32)] [?] assume !(~s~0 == ~NP~0); VAL [IofCallDriver_~DeviceObject=(_ bv0 32), IofCallDriver_~Irp=(_ bv0 32), IofCallDriver_~lcontext~0=(_ bv0 32), IofCallDriver_~returnVal2~0=(_ bv3221225473 32), IofCallDriver_~tmp_ndt_6~0=(_ bv1 32), IofCallDriver_~tmp_ndt_7~0=(_ bv1 32), |IofCallDriver_#in~DeviceObject|=(_ bv0 32), |IofCallDriver_#in~Irp|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv3 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv3 32), ~UNLOADED~0=(_ bv0 32)] [?] assume !(~s~0 == ~MPR1~0); VAL [IofCallDriver_~DeviceObject=(_ bv0 32), IofCallDriver_~Irp=(_ bv0 32), IofCallDriver_~lcontext~0=(_ bv0 32), IofCallDriver_~returnVal2~0=(_ bv3221225473 32), IofCallDriver_~tmp_ndt_6~0=(_ bv1 32), IofCallDriver_~tmp_ndt_7~0=(_ bv1 32), |IofCallDriver_#in~DeviceObject|=(_ bv0 32), |IofCallDriver_#in~Irp|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv3 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv3 32), ~UNLOADED~0=(_ bv0 32)] [?] assume ~s~0 == ~SKIP1~0;~s~0 := ~SKIP2~0;~lowerDriverReturn~0 := ~returnVal2~0; VAL [IofCallDriver_~DeviceObject=(_ bv0 32), IofCallDriver_~Irp=(_ bv0 32), IofCallDriver_~lcontext~0=(_ bv0 32), IofCallDriver_~returnVal2~0=(_ bv3221225473 32), IofCallDriver_~tmp_ndt_6~0=(_ bv1 32), IofCallDriver_~tmp_ndt_7~0=(_ bv1 32), |IofCallDriver_#in~DeviceObject|=(_ bv0 32), |IofCallDriver_#in~Irp|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv3 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv3221225473 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv4 32), ~UNLOADED~0=(_ bv0 32)] [?] #res := ~returnVal2~0; VAL [IofCallDriver_~DeviceObject=(_ bv0 32), IofCallDriver_~Irp=(_ bv0 32), IofCallDriver_~lcontext~0=(_ bv0 32), IofCallDriver_~returnVal2~0=(_ bv3221225473 32), IofCallDriver_~tmp_ndt_6~0=(_ bv1 32), IofCallDriver_~tmp_ndt_7~0=(_ bv1 32), |IofCallDriver_#in~DeviceObject|=(_ bv0 32), |IofCallDriver_#in~Irp|=(_ bv0 32), |IofCallDriver_#res|=(_ bv3221225473 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv3 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv3221225473 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv4 32), ~UNLOADED~0=(_ bv0 32)] [?] assume true; VAL [IofCallDriver_~DeviceObject=(_ bv0 32), IofCallDriver_~Irp=(_ bv0 32), IofCallDriver_~lcontext~0=(_ bv0 32), IofCallDriver_~returnVal2~0=(_ bv3221225473 32), IofCallDriver_~tmp_ndt_6~0=(_ bv1 32), IofCallDriver_~tmp_ndt_7~0=(_ bv1 32), |IofCallDriver_#in~DeviceObject|=(_ bv0 32), |IofCallDriver_#in~Irp|=(_ bv0 32), |IofCallDriver_#res|=(_ bv3221225473 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv3 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv3221225473 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv4 32), ~UNLOADED~0=(_ bv0 32)] [?] RET #783#return; VAL [KbFilter_PnP_~devExt__Removed~0=(_ bv1 32), KbFilter_PnP_~devExt__TopOfStack~0=(_ bv0 32), KbFilter_PnP_~devExt~0=(_ bv0 32), KbFilter_PnP_~DeviceObject=(_ bv0 32), KbFilter_PnP_~DeviceObject__DeviceExtension~0=(_ bv0 32), KbFilter_PnP_~event~0=(_ bv0 32), KbFilter_PnP_~Irp=(_ bv0 32), KbFilter_PnP_~Irp__CurrentLocation~0=(_ bv2147483648 32), KbFilter_PnP_~Irp__Tail__Overlay__CurrentStackLocation~0=(_ bv2147483648 32), KbFilter_PnP_~irpStack__MinorFunction~0=(_ bv2 32), KbFilter_PnP_~irpStack~0=(_ bv2147483647 32), KbFilter_PnP_~status~0=(_ bv0 32), |KbFilter_PnP_#in~DeviceObject|=(_ bv0 32), |KbFilter_PnP_#in~Irp|=(_ bv0 32), |KbFilter_PnP_#t~ret13|=(_ bv3221225473 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv1 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv3221225473 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv4 32), ~UNLOADED~0=(_ bv0 32)] [?] havoc #t~ret13;~status~0 := 0bv32; VAL [KbFilter_PnP_~devExt__Removed~0=(_ bv1 32), KbFilter_PnP_~devExt__TopOfStack~0=(_ bv0 32), KbFilter_PnP_~devExt~0=(_ bv0 32), KbFilter_PnP_~DeviceObject=(_ bv0 32), KbFilter_PnP_~DeviceObject__DeviceExtension~0=(_ bv0 32), KbFilter_PnP_~event~0=(_ bv0 32), KbFilter_PnP_~Irp=(_ bv0 32), KbFilter_PnP_~Irp__CurrentLocation~0=(_ bv2147483648 32), KbFilter_PnP_~Irp__Tail__Overlay__CurrentStackLocation~0=(_ bv2147483648 32), KbFilter_PnP_~irpStack__MinorFunction~0=(_ bv2 32), KbFilter_PnP_~irpStack~0=(_ bv2147483647 32), KbFilter_PnP_~status~0=(_ bv0 32), |KbFilter_PnP_#in~DeviceObject|=(_ bv0 32), |KbFilter_PnP_#in~Irp|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv1 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv3221225473 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv4 32), ~UNLOADED~0=(_ bv0 32)] [?] #res := ~status~0; VAL [KbFilter_PnP_~devExt__Removed~0=(_ bv1 32), KbFilter_PnP_~devExt__TopOfStack~0=(_ bv0 32), KbFilter_PnP_~devExt~0=(_ bv0 32), KbFilter_PnP_~DeviceObject=(_ bv0 32), KbFilter_PnP_~DeviceObject__DeviceExtension~0=(_ bv0 32), KbFilter_PnP_~event~0=(_ bv0 32), KbFilter_PnP_~Irp=(_ bv0 32), KbFilter_PnP_~Irp__CurrentLocation~0=(_ bv2147483648 32), KbFilter_PnP_~Irp__Tail__Overlay__CurrentStackLocation~0=(_ bv2147483648 32), KbFilter_PnP_~irpStack__MinorFunction~0=(_ bv2 32), KbFilter_PnP_~irpStack~0=(_ bv2147483647 32), KbFilter_PnP_~status~0=(_ bv0 32), |KbFilter_PnP_#in~DeviceObject|=(_ bv0 32), |KbFilter_PnP_#in~Irp|=(_ bv0 32), |KbFilter_PnP_#res|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv1 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv3221225473 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv4 32), ~UNLOADED~0=(_ bv0 32)] [?] assume true; VAL [KbFilter_PnP_~devExt__Removed~0=(_ bv1 32), KbFilter_PnP_~devExt__TopOfStack~0=(_ bv0 32), KbFilter_PnP_~devExt~0=(_ bv0 32), KbFilter_PnP_~DeviceObject=(_ bv0 32), KbFilter_PnP_~DeviceObject__DeviceExtension~0=(_ bv0 32), KbFilter_PnP_~event~0=(_ bv0 32), KbFilter_PnP_~Irp=(_ bv0 32), KbFilter_PnP_~Irp__CurrentLocation~0=(_ bv2147483648 32), KbFilter_PnP_~Irp__Tail__Overlay__CurrentStackLocation~0=(_ bv2147483648 32), KbFilter_PnP_~irpStack__MinorFunction~0=(_ bv2 32), KbFilter_PnP_~irpStack~0=(_ bv2147483647 32), KbFilter_PnP_~status~0=(_ bv0 32), |KbFilter_PnP_#in~DeviceObject|=(_ bv0 32), |KbFilter_PnP_#in~Irp|=(_ bv0 32), |KbFilter_PnP_#res|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv1 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv3221225473 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv4 32), ~UNLOADED~0=(_ bv0 32)] [?] RET #725#return; VAL [main_~devobj~0=(_ bv0 32), main_~irp_choice~0=(_ bv1 32), main_~irp~0=(_ bv0 32), main_~pirp__IoStatus__Status~0=(_ bv0 32), main_~pirp~0=(_ bv0 32), main_~status~1=(_ bv0 32), main_~tmp_ndt_1~0=(_ bv1 32), main_~tmp_ndt_2~0=(_ bv0 32), main_~tmp_ndt_3~0=(_ bv3 32), |main_#t~ret27|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv3221225473 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv4 32), ~UNLOADED~0=(_ bv0 32)] [?] ~status~1 := #t~ret27;havoc #t~ret27; VAL [main_~devobj~0=(_ bv0 32), main_~irp_choice~0=(_ bv1 32), main_~irp~0=(_ bv0 32), main_~pirp__IoStatus__Status~0=(_ bv0 32), main_~pirp~0=(_ bv0 32), main_~status~1=(_ bv0 32), main_~tmp_ndt_1~0=(_ bv1 32), main_~tmp_ndt_2~0=(_ bv0 32), main_~tmp_ndt_3~0=(_ bv3 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv3221225473 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv4 32), ~UNLOADED~0=(_ bv0 32)] [?] assume !(1bv32 == ~pended~0); VAL [main_~devobj~0=(_ bv0 32), main_~irp_choice~0=(_ bv1 32), main_~irp~0=(_ bv0 32), main_~pirp__IoStatus__Status~0=(_ bv0 32), main_~pirp~0=(_ bv0 32), main_~status~1=(_ bv0 32), main_~tmp_ndt_1~0=(_ bv1 32), main_~tmp_ndt_2~0=(_ bv0 32), main_~tmp_ndt_3~0=(_ bv3 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv3221225473 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv4 32), ~UNLOADED~0=(_ bv0 32)] [?] assume !(1bv32 == ~pended~0); VAL [main_~devobj~0=(_ bv0 32), main_~irp_choice~0=(_ bv1 32), main_~irp~0=(_ bv0 32), main_~pirp__IoStatus__Status~0=(_ bv0 32), main_~pirp~0=(_ bv0 32), main_~status~1=(_ bv0 32), main_~tmp_ndt_1~0=(_ bv1 32), main_~tmp_ndt_2~0=(_ bv0 32), main_~tmp_ndt_3~0=(_ bv3 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv3221225473 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv4 32), ~UNLOADED~0=(_ bv0 32)] [?] assume ~s~0 != ~UNLOADED~0; VAL [main_~devobj~0=(_ bv0 32), main_~irp_choice~0=(_ bv1 32), main_~irp~0=(_ bv0 32), main_~pirp__IoStatus__Status~0=(_ bv0 32), main_~pirp~0=(_ bv0 32), main_~status~1=(_ bv0 32), main_~tmp_ndt_1~0=(_ bv1 32), main_~tmp_ndt_2~0=(_ bv0 32), main_~tmp_ndt_3~0=(_ bv3 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv3221225473 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv4 32), ~UNLOADED~0=(_ bv0 32)] [?] assume 4294967295bv32 != ~status~1; VAL [main_~devobj~0=(_ bv0 32), main_~irp_choice~0=(_ bv1 32), main_~irp~0=(_ bv0 32), main_~pirp__IoStatus__Status~0=(_ bv0 32), main_~pirp~0=(_ bv0 32), main_~status~1=(_ bv0 32), main_~tmp_ndt_1~0=(_ bv1 32), main_~tmp_ndt_2~0=(_ bv0 32), main_~tmp_ndt_3~0=(_ bv3 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv3221225473 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv4 32), ~UNLOADED~0=(_ bv0 32)] [?] assume !(~s~0 != ~SKIP2~0); VAL [main_~devobj~0=(_ bv0 32), main_~irp_choice~0=(_ bv1 32), main_~irp~0=(_ bv0 32), main_~pirp__IoStatus__Status~0=(_ bv0 32), main_~pirp~0=(_ bv0 32), main_~status~1=(_ bv0 32), main_~tmp_ndt_1~0=(_ bv1 32), main_~tmp_ndt_2~0=(_ bv0 32), main_~tmp_ndt_3~0=(_ bv3 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv3221225473 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv4 32), ~UNLOADED~0=(_ bv0 32)] [?] assume !(1bv32 == ~pended~0); VAL [main_~devobj~0=(_ bv0 32), main_~irp_choice~0=(_ bv1 32), main_~irp~0=(_ bv0 32), main_~pirp__IoStatus__Status~0=(_ bv0 32), main_~pirp~0=(_ bv0 32), main_~status~1=(_ bv0 32), main_~tmp_ndt_1~0=(_ bv1 32), main_~tmp_ndt_2~0=(_ bv0 32), main_~tmp_ndt_3~0=(_ bv3 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv3221225473 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv4 32), ~UNLOADED~0=(_ bv0 32)] [?] assume !(~s~0 == ~DC~0); VAL [main_~devobj~0=(_ bv0 32), main_~irp_choice~0=(_ bv1 32), main_~irp~0=(_ bv0 32), main_~pirp__IoStatus__Status~0=(_ bv0 32), main_~pirp~0=(_ bv0 32), main_~status~1=(_ bv0 32), main_~tmp_ndt_1~0=(_ bv1 32), main_~tmp_ndt_2~0=(_ bv0 32), main_~tmp_ndt_3~0=(_ bv3 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv3221225473 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv4 32), ~UNLOADED~0=(_ bv0 32)] [?] assume ~status~1 != ~lowerDriverReturn~0; VAL [main_~devobj~0=(_ bv0 32), main_~irp_choice~0=(_ bv1 32), main_~irp~0=(_ bv0 32), main_~pirp__IoStatus__Status~0=(_ bv0 32), main_~pirp~0=(_ bv0 32), main_~status~1=(_ bv0 32), main_~tmp_ndt_1~0=(_ bv1 32), main_~tmp_ndt_2~0=(_ bv0 32), main_~tmp_ndt_3~0=(_ bv3 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv3221225473 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv4 32), ~UNLOADED~0=(_ bv0 32)] [?] CALL call errorFn(); VAL [|old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv3221225473 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv4 32), ~UNLOADED~0=(_ bv0 32)] [?] assume !false; VAL [|old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv3221225473 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv4 32), ~UNLOADED~0=(_ bv0 32)] [?] CALL call ULTIMATE.init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L22] ~KernelMode~0 := 0bv32; [L23] ~Executive~0 := 0bv32; [L24] ~DevicePowerState~0 := 0bv32; [L25] ~s~0 := 0bv32; [L26] ~UNLOADED~0 := 0bv32; [L27] ~NP~0 := 0bv32; [L28] ~DC~0 := 0bv32; [L29] ~SKIP1~0 := 0bv32; [L30] ~SKIP2~0 := 0bv32; [L31] ~MPR1~0 := 0bv32; [L32] ~MPR3~0 := 0bv32; [L33] ~IPC~0 := 0bv32; [L34] ~pended~0 := 0bv32; [L35] ~compFptr~0 := 0bv32; [L36] ~compRegistered~0 := 0bv32; [L37] ~lowerDriverReturn~0 := 0bv32; [L38] ~setEventCalled~0 := 0bv32; [L39] ~customIrp~0 := 0bv32; [L40] ~myStatus~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [?] ensures true; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [?] RET call ULTIMATE.init(); VAL [~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [?] CALL call #t~ret77 := main(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L293] havoc ~status~1; [L294] ~irp~0 := #t~nondet17; [L294] havoc #t~nondet17; [L295] havoc ~pirp~0; [L296] havoc ~pirp__IoStatus__Status~0; [L297] ~irp_choice~0 := #t~nondet18; [L297] havoc #t~nondet18; [L298] ~devobj~0 := #t~nondet19; [L298] havoc #t~nondet19; [L299] havoc ~__cil_tmp8~0; [L301] ~KernelMode~0 := 0bv32; [L302] ~Executive~0 := 0bv32; [L303] ~DevicePowerState~0 := 1bv32; [L304] ~s~0 := 0bv32; [L305] ~UNLOADED~0 := 0bv32; [L306] ~NP~0 := 0bv32; [L307] ~DC~0 := 0bv32; [L308] ~SKIP1~0 := 0bv32; [L309] ~SKIP2~0 := 0bv32; [L310] ~MPR1~0 := 0bv32; [L311] ~MPR3~0 := 0bv32; [L312] ~IPC~0 := 0bv32; [L313] ~pended~0 := 0bv32; [L314] ~compFptr~0 := 0bv32; [L315] ~compRegistered~0 := 0bv32; [L316] ~lowerDriverReturn~0 := 0bv32; [L317] ~setEventCalled~0 := 0bv32; [L318] ~customIrp~0 := 0bv32; [L319] ~myStatus~0 := 0bv32; [L323] ~status~1 := 0bv32; [L324] ~pirp~0 := ~irp~0; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~status~1=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L325] CALL call _BLAST_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L60] ~UNLOADED~0 := 0bv32; [L61] ~NP~0 := 1bv32; [L62] ~DC~0 := 2bv32; [L63] ~SKIP1~0 := 3bv32; [L64] ~SKIP2~0 := 4bv32; [L65] ~MPR1~0 := 5bv32; [L66] ~MPR3~0 := 6bv32; [L67] ~IPC~0 := 7bv32; [L68] ~s~0 := ~UNLOADED~0; [L69] ~pended~0 := 0bv32; [L70] ~compFptr~0 := 0bv32; [L71] ~compRegistered~0 := 0bv32; [L72] ~lowerDriverReturn~0 := 0bv32; [L73] ~setEventCalled~0 := 0bv32; [L74] ~customIrp~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L56-L77] ensures true; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L325] RET call _BLAST_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L327-L410] assume ~bvsge32(~status~1, 0bv32); [L328] ~s~0 := ~NP~0; [L329] ~customIrp~0 := 0bv32; [L330] ~setEventCalled~0 := ~customIrp~0; [L331] ~lowerDriverReturn~0 := ~setEventCalled~0; [L332] ~compRegistered~0 := ~lowerDriverReturn~0; [L333] ~pended~0 := ~compRegistered~0; [L334] ~pirp__IoStatus__Status~0 := 0bv32; [L335] ~myStatus~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L336-L339] assume !(0bv32 == ~irp_choice~0); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L341] CALL call stub_driver_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L46] ~s~0 := ~NP~0; [L47] ~pended~0 := 0bv32; [L48] ~compFptr~0 := 0bv32; [L49] ~compRegistered~0 := 0bv32; [L50] ~lowerDriverReturn~0 := 0bv32; [L51] ~setEventCalled~0 := 0bv32; [L52] ~customIrp~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L42-L55] ensures true; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L341] RET call stub_driver_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L344-L346] assume !~bvslt32(~status~1, 0bv32); [L348] havoc ~tmp_ndt_1~0; [L349] ~tmp_ndt_1~0 := #t~nondet20; [L349] havoc #t~nondet20; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~UNLOADED~0=0bv32] [L350-L409] assume !(0bv32 == ~tmp_ndt_1~0); [L353] havoc ~tmp_ndt_2~0; [L354] ~tmp_ndt_2~0 := #t~nondet21; [L354] havoc #t~nondet21; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~UNLOADED~0=0bv32] [L355-L408] assume !(1bv32 == ~tmp_ndt_2~0); [L358] havoc ~tmp_ndt_3~0; [L359] ~tmp_ndt_3~0 := #t~nondet22; [L359] havoc #t~nondet22; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L360-L407] assume 3bv32 == ~tmp_ndt_3~0; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L387] CALL call #t~ret27 := KbFilter_PnP(~devobj~0, ~pirp~0); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L78-L291] ~DeviceObject := #in~DeviceObject; [L78-L291] ~Irp := #in~Irp; [L79] havoc ~devExt~0; [L80] havoc ~irpStack~0; [L81] havoc ~status~0; [L82] ~event~0 := #t~nondet0; [L82] havoc #t~nondet0; [L83] ~DeviceObject__DeviceExtension~0 := #t~nondet1; [L83] havoc #t~nondet1; [L84] ~Irp__Tail__Overlay__CurrentStackLocation~0 := #t~nondet2; [L84] havoc #t~nondet2; [L85] ~irpStack__MinorFunction~0 := #t~nondet3; [L85] havoc #t~nondet3; [L86] ~devExt__TopOfStack~0 := #t~nondet4; [L86] havoc #t~nondet4; [L87] havoc ~devExt__Started~0; [L88] havoc ~devExt__Removed~0; [L89] havoc ~devExt__SurpriseRemoved~0; [L90] havoc ~Irp__IoStatus__Status~0; [L91] havoc ~Irp__IoStatus__Information~0; [L92] ~Irp__CurrentLocation~0 := #t~nondet5; [L92] havoc #t~nondet5; [L93] havoc ~irpSp~0; [L94] havoc ~nextIrpSp~0; [L95] havoc ~nextIrpSp__Control~0; [L96] havoc ~irpSp___0~0; [L97] havoc ~irpSp__Context~0; [L98] havoc ~irpSp__Control~0; [L99] havoc ~__cil_tmp23~0; [L102] ~status~0 := 0bv32; [L103] ~devExt~0 := ~DeviceObject__DeviceExtension~0; [L104] ~irpStack~0 := ~Irp__Tail__Overlay__CurrentStackLocation~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L105-L288] assume !(0bv32 == ~irpStack__MinorFunction~0); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L108-L287] assume !(23bv32 == ~irpStack__MinorFunction~0); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L111-L286] assume 2bv32 == ~irpStack__MinorFunction~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L235] ~devExt__Removed~0 := 1bv32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L236-L242] assume ~s~0 == ~NP~0; [L237] ~s~0 := ~SKIP1~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L244] #t~post11 := ~Irp__CurrentLocation~0; [L244] ~Irp__CurrentLocation~0 := ~bvadd32(1bv32, #t~post11); [L244] havoc #t~post11; [L245] #t~post12 := ~Irp__Tail__Overlay__CurrentStackLocation~0; [L245] ~Irp__Tail__Overlay__CurrentStackLocation~0 := ~bvadd32(1bv32, #t~post12); [L245] havoc #t~post12; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L246] CALL call #t~ret13 := IofCallDriver(~devExt__TopOfStack~0, ~Irp); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L480-L552] ~DeviceObject := #in~DeviceObject; [L480-L552] ~Irp := #in~Irp; [L482] havoc ~returnVal2~0; [L483] havoc ~compRetStatus~0; [L484] ~lcontext~0 := #t~nondet30; [L484] havoc #t~nondet30; [L485] havoc ~__cil_tmp7~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L488-L500] assume !(0bv32 != ~compRegistered~0); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L501] havoc ~tmp_ndt_6~0; [L502] ~tmp_ndt_6~0 := #t~nondet32; [L502] havoc #t~nondet32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~UNLOADED~0=0bv32] [L503-L526] assume !(0bv32 == ~tmp_ndt_6~0); [L506] havoc ~tmp_ndt_7~0; [L507] ~tmp_ndt_7~0 := #t~nondet33; [L507] havoc #t~nondet33; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L508-L525] assume 1bv32 == ~tmp_ndt_7~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L517] ~returnVal2~0 := 3221225473bv32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L527-L549] assume !(~s~0 == ~NP~0); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L531-L548] assume !(~s~0 == ~MPR1~0); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L540-L547] assume ~s~0 == ~SKIP1~0; [L541] ~s~0 := ~SKIP2~0; [L542] ~lowerDriverReturn~0 := ~returnVal2~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L550] #res := ~returnVal2~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #res=3221225473bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L9] ensures true; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #res=3221225473bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L246] RET call #t~ret13 := IofCallDriver(~devExt__TopOfStack~0, ~Irp); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #t~ret13=3221225473bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L246] havoc #t~ret13; [L247] ~status~0 := 0bv32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L289] #res := ~status~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #res=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L8] ensures true; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #res=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L387] RET call #t~ret27 := KbFilter_PnP(~devobj~0, ~pirp~0); VAL [#t~ret27=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L387] ~status~1 := #t~ret27; [L387] havoc #t~ret27; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L411-L462] assume !(1bv32 == ~pended~0); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L419-L461] assume !(1bv32 == ~pended~0); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L427-L460] assume ~s~0 != ~UNLOADED~0; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L428-L459] assume 4294967295bv32 != ~status~1; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L429-L458] assume !(~s~0 != ~SKIP2~0); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L439-L457] assume !(1bv32 == ~pended~0); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L446-L456] assume !(~s~0 == ~DC~0); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L451-L455] assume ~status~1 != ~lowerDriverReturn~0; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L452] CALL call errorFn(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L1012] assert false; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] ----- ----- class de.uni_freiburg.informatik.ultimate.boogie.preprocessor.BoogiePreprocessorBacktranslator [?] CALL call ULTIMATE.init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L22] ~KernelMode~0 := 0bv32; [L23] ~Executive~0 := 0bv32; [L24] ~DevicePowerState~0 := 0bv32; [L25] ~s~0 := 0bv32; [L26] ~UNLOADED~0 := 0bv32; [L27] ~NP~0 := 0bv32; [L28] ~DC~0 := 0bv32; [L29] ~SKIP1~0 := 0bv32; [L30] ~SKIP2~0 := 0bv32; [L31] ~MPR1~0 := 0bv32; [L32] ~MPR3~0 := 0bv32; [L33] ~IPC~0 := 0bv32; [L34] ~pended~0 := 0bv32; [L35] ~compFptr~0 := 0bv32; [L36] ~compRegistered~0 := 0bv32; [L37] ~lowerDriverReturn~0 := 0bv32; [L38] ~setEventCalled~0 := 0bv32; [L39] ~customIrp~0 := 0bv32; [L40] ~myStatus~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [?] ensures true; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [?] RET call ULTIMATE.init(); VAL [~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [?] CALL call #t~ret77 := main(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L293] havoc ~status~1; [L294] ~irp~0 := #t~nondet17; [L294] havoc #t~nondet17; [L295] havoc ~pirp~0; [L296] havoc ~pirp__IoStatus__Status~0; [L297] ~irp_choice~0 := #t~nondet18; [L297] havoc #t~nondet18; [L298] ~devobj~0 := #t~nondet19; [L298] havoc #t~nondet19; [L299] havoc ~__cil_tmp8~0; [L301] ~KernelMode~0 := 0bv32; [L302] ~Executive~0 := 0bv32; [L303] ~DevicePowerState~0 := 1bv32; [L304] ~s~0 := 0bv32; [L305] ~UNLOADED~0 := 0bv32; [L306] ~NP~0 := 0bv32; [L307] ~DC~0 := 0bv32; [L308] ~SKIP1~0 := 0bv32; [L309] ~SKIP2~0 := 0bv32; [L310] ~MPR1~0 := 0bv32; [L311] ~MPR3~0 := 0bv32; [L312] ~IPC~0 := 0bv32; [L313] ~pended~0 := 0bv32; [L314] ~compFptr~0 := 0bv32; [L315] ~compRegistered~0 := 0bv32; [L316] ~lowerDriverReturn~0 := 0bv32; [L317] ~setEventCalled~0 := 0bv32; [L318] ~customIrp~0 := 0bv32; [L319] ~myStatus~0 := 0bv32; [L323] ~status~1 := 0bv32; [L324] ~pirp~0 := ~irp~0; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~status~1=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L325] CALL call _BLAST_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L60] ~UNLOADED~0 := 0bv32; [L61] ~NP~0 := 1bv32; [L62] ~DC~0 := 2bv32; [L63] ~SKIP1~0 := 3bv32; [L64] ~SKIP2~0 := 4bv32; [L65] ~MPR1~0 := 5bv32; [L66] ~MPR3~0 := 6bv32; [L67] ~IPC~0 := 7bv32; [L68] ~s~0 := ~UNLOADED~0; [L69] ~pended~0 := 0bv32; [L70] ~compFptr~0 := 0bv32; [L71] ~compRegistered~0 := 0bv32; [L72] ~lowerDriverReturn~0 := 0bv32; [L73] ~setEventCalled~0 := 0bv32; [L74] ~customIrp~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L56-L77] ensures true; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L325] RET call _BLAST_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L327-L410] assume ~bvsge32(~status~1, 0bv32); [L328] ~s~0 := ~NP~0; [L329] ~customIrp~0 := 0bv32; [L330] ~setEventCalled~0 := ~customIrp~0; [L331] ~lowerDriverReturn~0 := ~setEventCalled~0; [L332] ~compRegistered~0 := ~lowerDriverReturn~0; [L333] ~pended~0 := ~compRegistered~0; [L334] ~pirp__IoStatus__Status~0 := 0bv32; [L335] ~myStatus~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L336-L339] assume !(0bv32 == ~irp_choice~0); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L341] CALL call stub_driver_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L46] ~s~0 := ~NP~0; [L47] ~pended~0 := 0bv32; [L48] ~compFptr~0 := 0bv32; [L49] ~compRegistered~0 := 0bv32; [L50] ~lowerDriverReturn~0 := 0bv32; [L51] ~setEventCalled~0 := 0bv32; [L52] ~customIrp~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L42-L55] ensures true; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L341] RET call stub_driver_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L344-L346] assume !~bvslt32(~status~1, 0bv32); [L348] havoc ~tmp_ndt_1~0; [L349] ~tmp_ndt_1~0 := #t~nondet20; [L349] havoc #t~nondet20; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~UNLOADED~0=0bv32] [L350-L409] assume !(0bv32 == ~tmp_ndt_1~0); [L353] havoc ~tmp_ndt_2~0; [L354] ~tmp_ndt_2~0 := #t~nondet21; [L354] havoc #t~nondet21; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~UNLOADED~0=0bv32] [L355-L408] assume !(1bv32 == ~tmp_ndt_2~0); [L358] havoc ~tmp_ndt_3~0; [L359] ~tmp_ndt_3~0 := #t~nondet22; [L359] havoc #t~nondet22; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L360-L407] assume 3bv32 == ~tmp_ndt_3~0; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L387] CALL call #t~ret27 := KbFilter_PnP(~devobj~0, ~pirp~0); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L78-L291] ~DeviceObject := #in~DeviceObject; [L78-L291] ~Irp := #in~Irp; [L79] havoc ~devExt~0; [L80] havoc ~irpStack~0; [L81] havoc ~status~0; [L82] ~event~0 := #t~nondet0; [L82] havoc #t~nondet0; [L83] ~DeviceObject__DeviceExtension~0 := #t~nondet1; [L83] havoc #t~nondet1; [L84] ~Irp__Tail__Overlay__CurrentStackLocation~0 := #t~nondet2; [L84] havoc #t~nondet2; [L85] ~irpStack__MinorFunction~0 := #t~nondet3; [L85] havoc #t~nondet3; [L86] ~devExt__TopOfStack~0 := #t~nondet4; [L86] havoc #t~nondet4; [L87] havoc ~devExt__Started~0; [L88] havoc ~devExt__Removed~0; [L89] havoc ~devExt__SurpriseRemoved~0; [L90] havoc ~Irp__IoStatus__Status~0; [L91] havoc ~Irp__IoStatus__Information~0; [L92] ~Irp__CurrentLocation~0 := #t~nondet5; [L92] havoc #t~nondet5; [L93] havoc ~irpSp~0; [L94] havoc ~nextIrpSp~0; [L95] havoc ~nextIrpSp__Control~0; [L96] havoc ~irpSp___0~0; [L97] havoc ~irpSp__Context~0; [L98] havoc ~irpSp__Control~0; [L99] havoc ~__cil_tmp23~0; [L102] ~status~0 := 0bv32; [L103] ~devExt~0 := ~DeviceObject__DeviceExtension~0; [L104] ~irpStack~0 := ~Irp__Tail__Overlay__CurrentStackLocation~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L105-L288] assume !(0bv32 == ~irpStack__MinorFunction~0); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L108-L287] assume !(23bv32 == ~irpStack__MinorFunction~0); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L111-L286] assume 2bv32 == ~irpStack__MinorFunction~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L235] ~devExt__Removed~0 := 1bv32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L236-L242] assume ~s~0 == ~NP~0; [L237] ~s~0 := ~SKIP1~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L244] #t~post11 := ~Irp__CurrentLocation~0; [L244] ~Irp__CurrentLocation~0 := ~bvadd32(1bv32, #t~post11); [L244] havoc #t~post11; [L245] #t~post12 := ~Irp__Tail__Overlay__CurrentStackLocation~0; [L245] ~Irp__Tail__Overlay__CurrentStackLocation~0 := ~bvadd32(1bv32, #t~post12); [L245] havoc #t~post12; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L246] CALL call #t~ret13 := IofCallDriver(~devExt__TopOfStack~0, ~Irp); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L480-L552] ~DeviceObject := #in~DeviceObject; [L480-L552] ~Irp := #in~Irp; [L482] havoc ~returnVal2~0; [L483] havoc ~compRetStatus~0; [L484] ~lcontext~0 := #t~nondet30; [L484] havoc #t~nondet30; [L485] havoc ~__cil_tmp7~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L488-L500] assume !(0bv32 != ~compRegistered~0); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L501] havoc ~tmp_ndt_6~0; [L502] ~tmp_ndt_6~0 := #t~nondet32; [L502] havoc #t~nondet32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~UNLOADED~0=0bv32] [L503-L526] assume !(0bv32 == ~tmp_ndt_6~0); [L506] havoc ~tmp_ndt_7~0; [L507] ~tmp_ndt_7~0 := #t~nondet33; [L507] havoc #t~nondet33; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L508-L525] assume 1bv32 == ~tmp_ndt_7~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L517] ~returnVal2~0 := 3221225473bv32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L527-L549] assume !(~s~0 == ~NP~0); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L531-L548] assume !(~s~0 == ~MPR1~0); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L540-L547] assume ~s~0 == ~SKIP1~0; [L541] ~s~0 := ~SKIP2~0; [L542] ~lowerDriverReturn~0 := ~returnVal2~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L550] #res := ~returnVal2~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #res=3221225473bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L9] ensures true; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #res=3221225473bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L246] RET call #t~ret13 := IofCallDriver(~devExt__TopOfStack~0, ~Irp); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #t~ret13=3221225473bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L246] havoc #t~ret13; [L247] ~status~0 := 0bv32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L289] #res := ~status~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #res=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L8] ensures true; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #res=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L387] RET call #t~ret27 := KbFilter_PnP(~devobj~0, ~pirp~0); VAL [#t~ret27=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L387] ~status~1 := #t~ret27; [L387] havoc #t~ret27; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L411-L462] assume !(1bv32 == ~pended~0); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L419-L461] assume !(1bv32 == ~pended~0); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L427-L460] assume ~s~0 != ~UNLOADED~0; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L428-L459] assume 4294967295bv32 != ~status~1; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L429-L458] assume !(~s~0 != ~SKIP2~0); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L439-L457] assume !(1bv32 == ~pended~0); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L446-L456] assume !(~s~0 == ~DC~0); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L451-L455] assume ~status~1 != ~lowerDriverReturn~0; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L452] CALL call errorFn(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L1012] assert false; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [?] CALL call ULTIMATE.init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L22] ~KernelMode~0 := 0bv32; [L23] ~Executive~0 := 0bv32; [L24] ~DevicePowerState~0 := 0bv32; [L25] ~s~0 := 0bv32; [L26] ~UNLOADED~0 := 0bv32; [L27] ~NP~0 := 0bv32; [L28] ~DC~0 := 0bv32; [L29] ~SKIP1~0 := 0bv32; [L30] ~SKIP2~0 := 0bv32; [L31] ~MPR1~0 := 0bv32; [L32] ~MPR3~0 := 0bv32; [L33] ~IPC~0 := 0bv32; [L34] ~pended~0 := 0bv32; [L35] ~compFptr~0 := 0bv32; [L36] ~compRegistered~0 := 0bv32; [L37] ~lowerDriverReturn~0 := 0bv32; [L38] ~setEventCalled~0 := 0bv32; [L39] ~customIrp~0 := 0bv32; [L40] ~myStatus~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [?] RET call ULTIMATE.init(); VAL [~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [?] CALL call #t~ret77 := main(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L293] havoc ~status~1; [L294] ~irp~0 := #t~nondet17; [L294] havoc #t~nondet17; [L295] havoc ~pirp~0; [L296] havoc ~pirp__IoStatus__Status~0; [L297] ~irp_choice~0 := #t~nondet18; [L297] havoc #t~nondet18; [L298] ~devobj~0 := #t~nondet19; [L298] havoc #t~nondet19; [L299] havoc ~__cil_tmp8~0; [L301] ~KernelMode~0 := 0bv32; [L302] ~Executive~0 := 0bv32; [L303] ~DevicePowerState~0 := 1bv32; [L304] ~s~0 := 0bv32; [L305] ~UNLOADED~0 := 0bv32; [L306] ~NP~0 := 0bv32; [L307] ~DC~0 := 0bv32; [L308] ~SKIP1~0 := 0bv32; [L309] ~SKIP2~0 := 0bv32; [L310] ~MPR1~0 := 0bv32; [L311] ~MPR3~0 := 0bv32; [L312] ~IPC~0 := 0bv32; [L313] ~pended~0 := 0bv32; [L314] ~compFptr~0 := 0bv32; [L315] ~compRegistered~0 := 0bv32; [L316] ~lowerDriverReturn~0 := 0bv32; [L317] ~setEventCalled~0 := 0bv32; [L318] ~customIrp~0 := 0bv32; [L319] ~myStatus~0 := 0bv32; [L323] ~status~1 := 0bv32; [L324] ~pirp~0 := ~irp~0; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~status~1=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L325] CALL call _BLAST_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L60] ~UNLOADED~0 := 0bv32; [L61] ~NP~0 := 1bv32; [L62] ~DC~0 := 2bv32; [L63] ~SKIP1~0 := 3bv32; [L64] ~SKIP2~0 := 4bv32; [L65] ~MPR1~0 := 5bv32; [L66] ~MPR3~0 := 6bv32; [L67] ~IPC~0 := 7bv32; [L68] ~s~0 := ~UNLOADED~0; [L69] ~pended~0 := 0bv32; [L70] ~compFptr~0 := 0bv32; [L71] ~compRegistered~0 := 0bv32; [L72] ~lowerDriverReturn~0 := 0bv32; [L73] ~setEventCalled~0 := 0bv32; [L74] ~customIrp~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L325] RET call _BLAST_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L327] COND TRUE ~bvsge32(~status~1, 0bv32) [L328] ~s~0 := ~NP~0; [L329] ~customIrp~0 := 0bv32; [L330] ~setEventCalled~0 := ~customIrp~0; [L331] ~lowerDriverReturn~0 := ~setEventCalled~0; [L332] ~compRegistered~0 := ~lowerDriverReturn~0; [L333] ~pended~0 := ~compRegistered~0; [L334] ~pirp__IoStatus__Status~0 := 0bv32; [L335] ~myStatus~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L336] COND FALSE !(0bv32 == ~irp_choice~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L341] CALL call stub_driver_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L46] ~s~0 := ~NP~0; [L47] ~pended~0 := 0bv32; [L48] ~compFptr~0 := 0bv32; [L49] ~compRegistered~0 := 0bv32; [L50] ~lowerDriverReturn~0 := 0bv32; [L51] ~setEventCalled~0 := 0bv32; [L52] ~customIrp~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L341] RET call stub_driver_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L344] COND FALSE !(~bvslt32(~status~1, 0bv32)) [L348] havoc ~tmp_ndt_1~0; [L349] ~tmp_ndt_1~0 := #t~nondet20; [L349] havoc #t~nondet20; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~UNLOADED~0=0bv32] [L350] COND FALSE !(0bv32 == ~tmp_ndt_1~0) [L353] havoc ~tmp_ndt_2~0; [L354] ~tmp_ndt_2~0 := #t~nondet21; [L354] havoc #t~nondet21; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~UNLOADED~0=0bv32] [L355] COND FALSE !(1bv32 == ~tmp_ndt_2~0) [L358] havoc ~tmp_ndt_3~0; [L359] ~tmp_ndt_3~0 := #t~nondet22; [L359] havoc #t~nondet22; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L360] COND TRUE 3bv32 == ~tmp_ndt_3~0 VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L387] CALL call #t~ret27 := KbFilter_PnP(~devobj~0, ~pirp~0); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L78-L291] ~DeviceObject := #in~DeviceObject; [L78-L291] ~Irp := #in~Irp; [L79] havoc ~devExt~0; [L80] havoc ~irpStack~0; [L81] havoc ~status~0; [L82] ~event~0 := #t~nondet0; [L82] havoc #t~nondet0; [L83] ~DeviceObject__DeviceExtension~0 := #t~nondet1; [L83] havoc #t~nondet1; [L84] ~Irp__Tail__Overlay__CurrentStackLocation~0 := #t~nondet2; [L84] havoc #t~nondet2; [L85] ~irpStack__MinorFunction~0 := #t~nondet3; [L85] havoc #t~nondet3; [L86] ~devExt__TopOfStack~0 := #t~nondet4; [L86] havoc #t~nondet4; [L87] havoc ~devExt__Started~0; [L88] havoc ~devExt__Removed~0; [L89] havoc ~devExt__SurpriseRemoved~0; [L90] havoc ~Irp__IoStatus__Status~0; [L91] havoc ~Irp__IoStatus__Information~0; [L92] ~Irp__CurrentLocation~0 := #t~nondet5; [L92] havoc #t~nondet5; [L93] havoc ~irpSp~0; [L94] havoc ~nextIrpSp~0; [L95] havoc ~nextIrpSp__Control~0; [L96] havoc ~irpSp___0~0; [L97] havoc ~irpSp__Context~0; [L98] havoc ~irpSp__Control~0; [L99] havoc ~__cil_tmp23~0; [L102] ~status~0 := 0bv32; [L103] ~devExt~0 := ~DeviceObject__DeviceExtension~0; [L104] ~irpStack~0 := ~Irp__Tail__Overlay__CurrentStackLocation~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L105] COND FALSE !(0bv32 == ~irpStack__MinorFunction~0) VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L108] COND FALSE !(23bv32 == ~irpStack__MinorFunction~0) VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L111] COND TRUE 2bv32 == ~irpStack__MinorFunction~0 VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L235] ~devExt__Removed~0 := 1bv32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L236] COND TRUE ~s~0 == ~NP~0 [L237] ~s~0 := ~SKIP1~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L244] #t~post11 := ~Irp__CurrentLocation~0; [L244] ~Irp__CurrentLocation~0 := ~bvadd32(1bv32, #t~post11); [L244] havoc #t~post11; [L245] #t~post12 := ~Irp__Tail__Overlay__CurrentStackLocation~0; [L245] ~Irp__Tail__Overlay__CurrentStackLocation~0 := ~bvadd32(1bv32, #t~post12); [L245] havoc #t~post12; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L246] CALL call #t~ret13 := IofCallDriver(~devExt__TopOfStack~0, ~Irp); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L480-L552] ~DeviceObject := #in~DeviceObject; [L480-L552] ~Irp := #in~Irp; [L482] havoc ~returnVal2~0; [L483] havoc ~compRetStatus~0; [L484] ~lcontext~0 := #t~nondet30; [L484] havoc #t~nondet30; [L485] havoc ~__cil_tmp7~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L488-L500] COND FALSE !(0bv32 != ~compRegistered~0) VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L501] havoc ~tmp_ndt_6~0; [L502] ~tmp_ndt_6~0 := #t~nondet32; [L502] havoc #t~nondet32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~UNLOADED~0=0bv32] [L503] COND FALSE !(0bv32 == ~tmp_ndt_6~0) [L506] havoc ~tmp_ndt_7~0; [L507] ~tmp_ndt_7~0 := #t~nondet33; [L507] havoc #t~nondet33; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L508] COND TRUE 1bv32 == ~tmp_ndt_7~0 VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L517] ~returnVal2~0 := 3221225473bv32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L527] COND FALSE !(~s~0 == ~NP~0) VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L531] COND FALSE !(~s~0 == ~MPR1~0) VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L540] COND TRUE ~s~0 == ~SKIP1~0 [L541] ~s~0 := ~SKIP2~0; [L542] ~lowerDriverReturn~0 := ~returnVal2~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L550] #res := ~returnVal2~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #res=3221225473bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L246] RET call #t~ret13 := IofCallDriver(~devExt__TopOfStack~0, ~Irp); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #t~ret13=3221225473bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L246] havoc #t~ret13; [L247] ~status~0 := 0bv32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L289] #res := ~status~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #res=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L387] RET call #t~ret27 := KbFilter_PnP(~devobj~0, ~pirp~0); VAL [#t~ret27=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L387] ~status~1 := #t~ret27; [L387] havoc #t~ret27; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L411] COND FALSE !(1bv32 == ~pended~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L419] COND FALSE !(1bv32 == ~pended~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L427] COND TRUE ~s~0 != ~UNLOADED~0 VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L428] COND TRUE 4294967295bv32 != ~status~1 VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L429] COND FALSE !(~s~0 != ~SKIP2~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L439] COND FALSE !(1bv32 == ~pended~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L446] COND FALSE !(~s~0 == ~DC~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L451] COND TRUE ~status~1 != ~lowerDriverReturn~0 VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L452] CALL call errorFn(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L1012] assert false; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] ----- ----- class de.uni_freiburg.informatik.ultimate.boogie.procedureinliner.backtranslation.InlinerBacktranslator [?] CALL call ULTIMATE.init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L22] ~KernelMode~0 := 0bv32; [L23] ~Executive~0 := 0bv32; [L24] ~DevicePowerState~0 := 0bv32; [L25] ~s~0 := 0bv32; [L26] ~UNLOADED~0 := 0bv32; [L27] ~NP~0 := 0bv32; [L28] ~DC~0 := 0bv32; [L29] ~SKIP1~0 := 0bv32; [L30] ~SKIP2~0 := 0bv32; [L31] ~MPR1~0 := 0bv32; [L32] ~MPR3~0 := 0bv32; [L33] ~IPC~0 := 0bv32; [L34] ~pended~0 := 0bv32; [L35] ~compFptr~0 := 0bv32; [L36] ~compRegistered~0 := 0bv32; [L37] ~lowerDriverReturn~0 := 0bv32; [L38] ~setEventCalled~0 := 0bv32; [L39] ~customIrp~0 := 0bv32; [L40] ~myStatus~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [?] RET call ULTIMATE.init(); VAL [~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [?] CALL call #t~ret77 := main(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L293] havoc ~status~1; [L294] ~irp~0 := #t~nondet17; [L294] havoc #t~nondet17; [L295] havoc ~pirp~0; [L296] havoc ~pirp__IoStatus__Status~0; [L297] ~irp_choice~0 := #t~nondet18; [L297] havoc #t~nondet18; [L298] ~devobj~0 := #t~nondet19; [L298] havoc #t~nondet19; [L299] havoc ~__cil_tmp8~0; [L301] ~KernelMode~0 := 0bv32; [L302] ~Executive~0 := 0bv32; [L303] ~DevicePowerState~0 := 1bv32; [L304] ~s~0 := 0bv32; [L305] ~UNLOADED~0 := 0bv32; [L306] ~NP~0 := 0bv32; [L307] ~DC~0 := 0bv32; [L308] ~SKIP1~0 := 0bv32; [L309] ~SKIP2~0 := 0bv32; [L310] ~MPR1~0 := 0bv32; [L311] ~MPR3~0 := 0bv32; [L312] ~IPC~0 := 0bv32; [L313] ~pended~0 := 0bv32; [L314] ~compFptr~0 := 0bv32; [L315] ~compRegistered~0 := 0bv32; [L316] ~lowerDriverReturn~0 := 0bv32; [L317] ~setEventCalled~0 := 0bv32; [L318] ~customIrp~0 := 0bv32; [L319] ~myStatus~0 := 0bv32; [L323] ~status~1 := 0bv32; [L324] ~pirp~0 := ~irp~0; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~status~1=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L325] CALL call _BLAST_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L60] ~UNLOADED~0 := 0bv32; [L61] ~NP~0 := 1bv32; [L62] ~DC~0 := 2bv32; [L63] ~SKIP1~0 := 3bv32; [L64] ~SKIP2~0 := 4bv32; [L65] ~MPR1~0 := 5bv32; [L66] ~MPR3~0 := 6bv32; [L67] ~IPC~0 := 7bv32; [L68] ~s~0 := ~UNLOADED~0; [L69] ~pended~0 := 0bv32; [L70] ~compFptr~0 := 0bv32; [L71] ~compRegistered~0 := 0bv32; [L72] ~lowerDriverReturn~0 := 0bv32; [L73] ~setEventCalled~0 := 0bv32; [L74] ~customIrp~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L325] RET call _BLAST_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L327] COND TRUE ~bvsge32(~status~1, 0bv32) [L328] ~s~0 := ~NP~0; [L329] ~customIrp~0 := 0bv32; [L330] ~setEventCalled~0 := ~customIrp~0; [L331] ~lowerDriverReturn~0 := ~setEventCalled~0; [L332] ~compRegistered~0 := ~lowerDriverReturn~0; [L333] ~pended~0 := ~compRegistered~0; [L334] ~pirp__IoStatus__Status~0 := 0bv32; [L335] ~myStatus~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L336] COND FALSE !(0bv32 == ~irp_choice~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L341] CALL call stub_driver_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L46] ~s~0 := ~NP~0; [L47] ~pended~0 := 0bv32; [L48] ~compFptr~0 := 0bv32; [L49] ~compRegistered~0 := 0bv32; [L50] ~lowerDriverReturn~0 := 0bv32; [L51] ~setEventCalled~0 := 0bv32; [L52] ~customIrp~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L341] RET call stub_driver_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L344] COND FALSE !(~bvslt32(~status~1, 0bv32)) [L348] havoc ~tmp_ndt_1~0; [L349] ~tmp_ndt_1~0 := #t~nondet20; [L349] havoc #t~nondet20; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~UNLOADED~0=0bv32] [L350] COND FALSE !(0bv32 == ~tmp_ndt_1~0) [L353] havoc ~tmp_ndt_2~0; [L354] ~tmp_ndt_2~0 := #t~nondet21; [L354] havoc #t~nondet21; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~UNLOADED~0=0bv32] [L355] COND FALSE !(1bv32 == ~tmp_ndt_2~0) [L358] havoc ~tmp_ndt_3~0; [L359] ~tmp_ndt_3~0 := #t~nondet22; [L359] havoc #t~nondet22; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L360] COND TRUE 3bv32 == ~tmp_ndt_3~0 VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L387] CALL call #t~ret27 := KbFilter_PnP(~devobj~0, ~pirp~0); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L78-L291] ~DeviceObject := #in~DeviceObject; [L78-L291] ~Irp := #in~Irp; [L79] havoc ~devExt~0; [L80] havoc ~irpStack~0; [L81] havoc ~status~0; [L82] ~event~0 := #t~nondet0; [L82] havoc #t~nondet0; [L83] ~DeviceObject__DeviceExtension~0 := #t~nondet1; [L83] havoc #t~nondet1; [L84] ~Irp__Tail__Overlay__CurrentStackLocation~0 := #t~nondet2; [L84] havoc #t~nondet2; [L85] ~irpStack__MinorFunction~0 := #t~nondet3; [L85] havoc #t~nondet3; [L86] ~devExt__TopOfStack~0 := #t~nondet4; [L86] havoc #t~nondet4; [L87] havoc ~devExt__Started~0; [L88] havoc ~devExt__Removed~0; [L89] havoc ~devExt__SurpriseRemoved~0; [L90] havoc ~Irp__IoStatus__Status~0; [L91] havoc ~Irp__IoStatus__Information~0; [L92] ~Irp__CurrentLocation~0 := #t~nondet5; [L92] havoc #t~nondet5; [L93] havoc ~irpSp~0; [L94] havoc ~nextIrpSp~0; [L95] havoc ~nextIrpSp__Control~0; [L96] havoc ~irpSp___0~0; [L97] havoc ~irpSp__Context~0; [L98] havoc ~irpSp__Control~0; [L99] havoc ~__cil_tmp23~0; [L102] ~status~0 := 0bv32; [L103] ~devExt~0 := ~DeviceObject__DeviceExtension~0; [L104] ~irpStack~0 := ~Irp__Tail__Overlay__CurrentStackLocation~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L105] COND FALSE !(0bv32 == ~irpStack__MinorFunction~0) VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L108] COND FALSE !(23bv32 == ~irpStack__MinorFunction~0) VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L111] COND TRUE 2bv32 == ~irpStack__MinorFunction~0 VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L235] ~devExt__Removed~0 := 1bv32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L236] COND TRUE ~s~0 == ~NP~0 [L237] ~s~0 := ~SKIP1~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L244] #t~post11 := ~Irp__CurrentLocation~0; [L244] ~Irp__CurrentLocation~0 := ~bvadd32(1bv32, #t~post11); [L244] havoc #t~post11; [L245] #t~post12 := ~Irp__Tail__Overlay__CurrentStackLocation~0; [L245] ~Irp__Tail__Overlay__CurrentStackLocation~0 := ~bvadd32(1bv32, #t~post12); [L245] havoc #t~post12; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L246] CALL call #t~ret13 := IofCallDriver(~devExt__TopOfStack~0, ~Irp); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L480-L552] ~DeviceObject := #in~DeviceObject; [L480-L552] ~Irp := #in~Irp; [L482] havoc ~returnVal2~0; [L483] havoc ~compRetStatus~0; [L484] ~lcontext~0 := #t~nondet30; [L484] havoc #t~nondet30; [L485] havoc ~__cil_tmp7~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L488-L500] COND FALSE !(0bv32 != ~compRegistered~0) VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L501] havoc ~tmp_ndt_6~0; [L502] ~tmp_ndt_6~0 := #t~nondet32; [L502] havoc #t~nondet32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~UNLOADED~0=0bv32] [L503] COND FALSE !(0bv32 == ~tmp_ndt_6~0) [L506] havoc ~tmp_ndt_7~0; [L507] ~tmp_ndt_7~0 := #t~nondet33; [L507] havoc #t~nondet33; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L508] COND TRUE 1bv32 == ~tmp_ndt_7~0 VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L517] ~returnVal2~0 := 3221225473bv32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L527] COND FALSE !(~s~0 == ~NP~0) VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L531] COND FALSE !(~s~0 == ~MPR1~0) VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L540] COND TRUE ~s~0 == ~SKIP1~0 [L541] ~s~0 := ~SKIP2~0; [L542] ~lowerDriverReturn~0 := ~returnVal2~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L550] #res := ~returnVal2~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #res=3221225473bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L246] RET call #t~ret13 := IofCallDriver(~devExt__TopOfStack~0, ~Irp); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #t~ret13=3221225473bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L246] havoc #t~ret13; [L247] ~status~0 := 0bv32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L289] #res := ~status~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #res=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L387] RET call #t~ret27 := KbFilter_PnP(~devobj~0, ~pirp~0); VAL [#t~ret27=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L387] ~status~1 := #t~ret27; [L387] havoc #t~ret27; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L411] COND FALSE !(1bv32 == ~pended~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L419] COND FALSE !(1bv32 == ~pended~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L427] COND TRUE ~s~0 != ~UNLOADED~0 VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L428] COND TRUE 4294967295bv32 != ~status~1 VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L429] COND FALSE !(~s~0 != ~SKIP2~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L439] COND FALSE !(1bv32 == ~pended~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L446] COND FALSE !(~s~0 == ~DC~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L451] COND TRUE ~status~1 != ~lowerDriverReturn~0 VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L452] CALL call errorFn(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L1012] assert false; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [?] CALL call ULTIMATE.init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L22] ~KernelMode~0 := 0bv32; [L23] ~Executive~0 := 0bv32; [L24] ~DevicePowerState~0 := 0bv32; [L25] ~s~0 := 0bv32; [L26] ~UNLOADED~0 := 0bv32; [L27] ~NP~0 := 0bv32; [L28] ~DC~0 := 0bv32; [L29] ~SKIP1~0 := 0bv32; [L30] ~SKIP2~0 := 0bv32; [L31] ~MPR1~0 := 0bv32; [L32] ~MPR3~0 := 0bv32; [L33] ~IPC~0 := 0bv32; [L34] ~pended~0 := 0bv32; [L35] ~compFptr~0 := 0bv32; [L36] ~compRegistered~0 := 0bv32; [L37] ~lowerDriverReturn~0 := 0bv32; [L38] ~setEventCalled~0 := 0bv32; [L39] ~customIrp~0 := 0bv32; [L40] ~myStatus~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [?] RET call ULTIMATE.init(); VAL [~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [?] CALL call #t~ret77 := main(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L293] havoc ~status~1; [L294] ~irp~0 := #t~nondet17; [L294] havoc #t~nondet17; [L295] havoc ~pirp~0; [L296] havoc ~pirp__IoStatus__Status~0; [L297] ~irp_choice~0 := #t~nondet18; [L297] havoc #t~nondet18; [L298] ~devobj~0 := #t~nondet19; [L298] havoc #t~nondet19; [L299] havoc ~__cil_tmp8~0; [L301] ~KernelMode~0 := 0bv32; [L302] ~Executive~0 := 0bv32; [L303] ~DevicePowerState~0 := 1bv32; [L304] ~s~0 := 0bv32; [L305] ~UNLOADED~0 := 0bv32; [L306] ~NP~0 := 0bv32; [L307] ~DC~0 := 0bv32; [L308] ~SKIP1~0 := 0bv32; [L309] ~SKIP2~0 := 0bv32; [L310] ~MPR1~0 := 0bv32; [L311] ~MPR3~0 := 0bv32; [L312] ~IPC~0 := 0bv32; [L313] ~pended~0 := 0bv32; [L314] ~compFptr~0 := 0bv32; [L315] ~compRegistered~0 := 0bv32; [L316] ~lowerDriverReturn~0 := 0bv32; [L317] ~setEventCalled~0 := 0bv32; [L318] ~customIrp~0 := 0bv32; [L319] ~myStatus~0 := 0bv32; [L323] ~status~1 := 0bv32; [L324] ~pirp~0 := ~irp~0; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~status~1=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L325] CALL call _BLAST_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L60] ~UNLOADED~0 := 0bv32; [L61] ~NP~0 := 1bv32; [L62] ~DC~0 := 2bv32; [L63] ~SKIP1~0 := 3bv32; [L64] ~SKIP2~0 := 4bv32; [L65] ~MPR1~0 := 5bv32; [L66] ~MPR3~0 := 6bv32; [L67] ~IPC~0 := 7bv32; [L68] ~s~0 := ~UNLOADED~0; [L69] ~pended~0 := 0bv32; [L70] ~compFptr~0 := 0bv32; [L71] ~compRegistered~0 := 0bv32; [L72] ~lowerDriverReturn~0 := 0bv32; [L73] ~setEventCalled~0 := 0bv32; [L74] ~customIrp~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L325] RET call _BLAST_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L327] COND TRUE ~bvsge32(~status~1, 0bv32) [L328] ~s~0 := ~NP~0; [L329] ~customIrp~0 := 0bv32; [L330] ~setEventCalled~0 := ~customIrp~0; [L331] ~lowerDriverReturn~0 := ~setEventCalled~0; [L332] ~compRegistered~0 := ~lowerDriverReturn~0; [L333] ~pended~0 := ~compRegistered~0; [L334] ~pirp__IoStatus__Status~0 := 0bv32; [L335] ~myStatus~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L336] COND FALSE !(0bv32 == ~irp_choice~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L341] CALL call stub_driver_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L46] ~s~0 := ~NP~0; [L47] ~pended~0 := 0bv32; [L48] ~compFptr~0 := 0bv32; [L49] ~compRegistered~0 := 0bv32; [L50] ~lowerDriverReturn~0 := 0bv32; [L51] ~setEventCalled~0 := 0bv32; [L52] ~customIrp~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L341] RET call stub_driver_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L344] COND FALSE !(~bvslt32(~status~1, 0bv32)) [L348] havoc ~tmp_ndt_1~0; [L349] ~tmp_ndt_1~0 := #t~nondet20; [L349] havoc #t~nondet20; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~UNLOADED~0=0bv32] [L350] COND FALSE !(0bv32 == ~tmp_ndt_1~0) [L353] havoc ~tmp_ndt_2~0; [L354] ~tmp_ndt_2~0 := #t~nondet21; [L354] havoc #t~nondet21; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~UNLOADED~0=0bv32] [L355] COND FALSE !(1bv32 == ~tmp_ndt_2~0) [L358] havoc ~tmp_ndt_3~0; [L359] ~tmp_ndt_3~0 := #t~nondet22; [L359] havoc #t~nondet22; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L360] COND TRUE 3bv32 == ~tmp_ndt_3~0 VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L387] CALL call #t~ret27 := KbFilter_PnP(~devobj~0, ~pirp~0); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L78-L291] ~DeviceObject := #in~DeviceObject; [L78-L291] ~Irp := #in~Irp; [L79] havoc ~devExt~0; [L80] havoc ~irpStack~0; [L81] havoc ~status~0; [L82] ~event~0 := #t~nondet0; [L82] havoc #t~nondet0; [L83] ~DeviceObject__DeviceExtension~0 := #t~nondet1; [L83] havoc #t~nondet1; [L84] ~Irp__Tail__Overlay__CurrentStackLocation~0 := #t~nondet2; [L84] havoc #t~nondet2; [L85] ~irpStack__MinorFunction~0 := #t~nondet3; [L85] havoc #t~nondet3; [L86] ~devExt__TopOfStack~0 := #t~nondet4; [L86] havoc #t~nondet4; [L87] havoc ~devExt__Started~0; [L88] havoc ~devExt__Removed~0; [L89] havoc ~devExt__SurpriseRemoved~0; [L90] havoc ~Irp__IoStatus__Status~0; [L91] havoc ~Irp__IoStatus__Information~0; [L92] ~Irp__CurrentLocation~0 := #t~nondet5; [L92] havoc #t~nondet5; [L93] havoc ~irpSp~0; [L94] havoc ~nextIrpSp~0; [L95] havoc ~nextIrpSp__Control~0; [L96] havoc ~irpSp___0~0; [L97] havoc ~irpSp__Context~0; [L98] havoc ~irpSp__Control~0; [L99] havoc ~__cil_tmp23~0; [L102] ~status~0 := 0bv32; [L103] ~devExt~0 := ~DeviceObject__DeviceExtension~0; [L104] ~irpStack~0 := ~Irp__Tail__Overlay__CurrentStackLocation~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L105] COND FALSE !(0bv32 == ~irpStack__MinorFunction~0) VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L108] COND FALSE !(23bv32 == ~irpStack__MinorFunction~0) VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L111] COND TRUE 2bv32 == ~irpStack__MinorFunction~0 VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L235] ~devExt__Removed~0 := 1bv32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L236] COND TRUE ~s~0 == ~NP~0 [L237] ~s~0 := ~SKIP1~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L244] #t~post11 := ~Irp__CurrentLocation~0; [L244] ~Irp__CurrentLocation~0 := ~bvadd32(1bv32, #t~post11); [L244] havoc #t~post11; [L245] #t~post12 := ~Irp__Tail__Overlay__CurrentStackLocation~0; [L245] ~Irp__Tail__Overlay__CurrentStackLocation~0 := ~bvadd32(1bv32, #t~post12); [L245] havoc #t~post12; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L246] CALL call #t~ret13 := IofCallDriver(~devExt__TopOfStack~0, ~Irp); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L480-L552] ~DeviceObject := #in~DeviceObject; [L480-L552] ~Irp := #in~Irp; [L482] havoc ~returnVal2~0; [L483] havoc ~compRetStatus~0; [L484] ~lcontext~0 := #t~nondet30; [L484] havoc #t~nondet30; [L485] havoc ~__cil_tmp7~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L488-L500] COND FALSE !(0bv32 != ~compRegistered~0) VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L501] havoc ~tmp_ndt_6~0; [L502] ~tmp_ndt_6~0 := #t~nondet32; [L502] havoc #t~nondet32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~UNLOADED~0=0bv32] [L503] COND FALSE !(0bv32 == ~tmp_ndt_6~0) [L506] havoc ~tmp_ndt_7~0; [L507] ~tmp_ndt_7~0 := #t~nondet33; [L507] havoc #t~nondet33; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L508] COND TRUE 1bv32 == ~tmp_ndt_7~0 VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L517] ~returnVal2~0 := 3221225473bv32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L527] COND FALSE !(~s~0 == ~NP~0) VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L531] COND FALSE !(~s~0 == ~MPR1~0) VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L540] COND TRUE ~s~0 == ~SKIP1~0 [L541] ~s~0 := ~SKIP2~0; [L542] ~lowerDriverReturn~0 := ~returnVal2~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L550] #res := ~returnVal2~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #res=3221225473bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L246] RET call #t~ret13 := IofCallDriver(~devExt__TopOfStack~0, ~Irp); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #t~ret13=3221225473bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L246] havoc #t~ret13; [L247] ~status~0 := 0bv32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L289] #res := ~status~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #res=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L387] RET call #t~ret27 := KbFilter_PnP(~devobj~0, ~pirp~0); VAL [#t~ret27=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L387] ~status~1 := #t~ret27; [L387] havoc #t~ret27; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L411] COND FALSE !(1bv32 == ~pended~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L419] COND FALSE !(1bv32 == ~pended~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L427] COND TRUE ~s~0 != ~UNLOADED~0 VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L428] COND TRUE 4294967295bv32 != ~status~1 VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L429] COND FALSE !(~s~0 != ~SKIP2~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L439] COND FALSE !(1bv32 == ~pended~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L446] COND FALSE !(~s~0 == ~DC~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L451] COND TRUE ~status~1 != ~lowerDriverReturn~0 VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L452] CALL call errorFn(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L1012] assert false; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] ----- ----- class de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator.CACSL2BoogieBacktranslator [?] CALL call ULTIMATE.init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L22] ~KernelMode~0 := 0bv32; [L23] ~Executive~0 := 0bv32; [L24] ~DevicePowerState~0 := 0bv32; [L25] ~s~0 := 0bv32; [L26] ~UNLOADED~0 := 0bv32; [L27] ~NP~0 := 0bv32; [L28] ~DC~0 := 0bv32; [L29] ~SKIP1~0 := 0bv32; [L30] ~SKIP2~0 := 0bv32; [L31] ~MPR1~0 := 0bv32; [L32] ~MPR3~0 := 0bv32; [L33] ~IPC~0 := 0bv32; [L34] ~pended~0 := 0bv32; [L35] ~compFptr~0 := 0bv32; [L36] ~compRegistered~0 := 0bv32; [L37] ~lowerDriverReturn~0 := 0bv32; [L38] ~setEventCalled~0 := 0bv32; [L39] ~customIrp~0 := 0bv32; [L40] ~myStatus~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [?] RET call ULTIMATE.init(); VAL [~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [?] CALL call #t~ret77 := main(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L293] havoc ~status~1; [L294] ~irp~0 := #t~nondet17; [L294] havoc #t~nondet17; [L295] havoc ~pirp~0; [L296] havoc ~pirp__IoStatus__Status~0; [L297] ~irp_choice~0 := #t~nondet18; [L297] havoc #t~nondet18; [L298] ~devobj~0 := #t~nondet19; [L298] havoc #t~nondet19; [L299] havoc ~__cil_tmp8~0; [L301] ~KernelMode~0 := 0bv32; [L302] ~Executive~0 := 0bv32; [L303] ~DevicePowerState~0 := 1bv32; [L304] ~s~0 := 0bv32; [L305] ~UNLOADED~0 := 0bv32; [L306] ~NP~0 := 0bv32; [L307] ~DC~0 := 0bv32; [L308] ~SKIP1~0 := 0bv32; [L309] ~SKIP2~0 := 0bv32; [L310] ~MPR1~0 := 0bv32; [L311] ~MPR3~0 := 0bv32; [L312] ~IPC~0 := 0bv32; [L313] ~pended~0 := 0bv32; [L314] ~compFptr~0 := 0bv32; [L315] ~compRegistered~0 := 0bv32; [L316] ~lowerDriverReturn~0 := 0bv32; [L317] ~setEventCalled~0 := 0bv32; [L318] ~customIrp~0 := 0bv32; [L319] ~myStatus~0 := 0bv32; [L323] ~status~1 := 0bv32; [L324] ~pirp~0 := ~irp~0; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~status~1=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L325] CALL call _BLAST_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L60] ~UNLOADED~0 := 0bv32; [L61] ~NP~0 := 1bv32; [L62] ~DC~0 := 2bv32; [L63] ~SKIP1~0 := 3bv32; [L64] ~SKIP2~0 := 4bv32; [L65] ~MPR1~0 := 5bv32; [L66] ~MPR3~0 := 6bv32; [L67] ~IPC~0 := 7bv32; [L68] ~s~0 := ~UNLOADED~0; [L69] ~pended~0 := 0bv32; [L70] ~compFptr~0 := 0bv32; [L71] ~compRegistered~0 := 0bv32; [L72] ~lowerDriverReturn~0 := 0bv32; [L73] ~setEventCalled~0 := 0bv32; [L74] ~customIrp~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L325] RET call _BLAST_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L327] COND TRUE ~bvsge32(~status~1, 0bv32) [L328] ~s~0 := ~NP~0; [L329] ~customIrp~0 := 0bv32; [L330] ~setEventCalled~0 := ~customIrp~0; [L331] ~lowerDriverReturn~0 := ~setEventCalled~0; [L332] ~compRegistered~0 := ~lowerDriverReturn~0; [L333] ~pended~0 := ~compRegistered~0; [L334] ~pirp__IoStatus__Status~0 := 0bv32; [L335] ~myStatus~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L336] COND FALSE !(0bv32 == ~irp_choice~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L341] CALL call stub_driver_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L46] ~s~0 := ~NP~0; [L47] ~pended~0 := 0bv32; [L48] ~compFptr~0 := 0bv32; [L49] ~compRegistered~0 := 0bv32; [L50] ~lowerDriverReturn~0 := 0bv32; [L51] ~setEventCalled~0 := 0bv32; [L52] ~customIrp~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L341] RET call stub_driver_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L344] COND FALSE !(~bvslt32(~status~1, 0bv32)) [L348] havoc ~tmp_ndt_1~0; [L349] ~tmp_ndt_1~0 := #t~nondet20; [L349] havoc #t~nondet20; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~UNLOADED~0=0bv32] [L350] COND FALSE !(0bv32 == ~tmp_ndt_1~0) [L353] havoc ~tmp_ndt_2~0; [L354] ~tmp_ndt_2~0 := #t~nondet21; [L354] havoc #t~nondet21; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~UNLOADED~0=0bv32] [L355] COND FALSE !(1bv32 == ~tmp_ndt_2~0) [L358] havoc ~tmp_ndt_3~0; [L359] ~tmp_ndt_3~0 := #t~nondet22; [L359] havoc #t~nondet22; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L360] COND TRUE 3bv32 == ~tmp_ndt_3~0 VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L387] CALL call #t~ret27 := KbFilter_PnP(~devobj~0, ~pirp~0); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L78-L291] ~DeviceObject := #in~DeviceObject; [L78-L291] ~Irp := #in~Irp; [L79] havoc ~devExt~0; [L80] havoc ~irpStack~0; [L81] havoc ~status~0; [L82] ~event~0 := #t~nondet0; [L82] havoc #t~nondet0; [L83] ~DeviceObject__DeviceExtension~0 := #t~nondet1; [L83] havoc #t~nondet1; [L84] ~Irp__Tail__Overlay__CurrentStackLocation~0 := #t~nondet2; [L84] havoc #t~nondet2; [L85] ~irpStack__MinorFunction~0 := #t~nondet3; [L85] havoc #t~nondet3; [L86] ~devExt__TopOfStack~0 := #t~nondet4; [L86] havoc #t~nondet4; [L87] havoc ~devExt__Started~0; [L88] havoc ~devExt__Removed~0; [L89] havoc ~devExt__SurpriseRemoved~0; [L90] havoc ~Irp__IoStatus__Status~0; [L91] havoc ~Irp__IoStatus__Information~0; [L92] ~Irp__CurrentLocation~0 := #t~nondet5; [L92] havoc #t~nondet5; [L93] havoc ~irpSp~0; [L94] havoc ~nextIrpSp~0; [L95] havoc ~nextIrpSp__Control~0; [L96] havoc ~irpSp___0~0; [L97] havoc ~irpSp__Context~0; [L98] havoc ~irpSp__Control~0; [L99] havoc ~__cil_tmp23~0; [L102] ~status~0 := 0bv32; [L103] ~devExt~0 := ~DeviceObject__DeviceExtension~0; [L104] ~irpStack~0 := ~Irp__Tail__Overlay__CurrentStackLocation~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L105] COND FALSE !(0bv32 == ~irpStack__MinorFunction~0) VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L108] COND FALSE !(23bv32 == ~irpStack__MinorFunction~0) VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L111] COND TRUE 2bv32 == ~irpStack__MinorFunction~0 VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L235] ~devExt__Removed~0 := 1bv32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L236] COND TRUE ~s~0 == ~NP~0 [L237] ~s~0 := ~SKIP1~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L244] #t~post11 := ~Irp__CurrentLocation~0; [L244] ~Irp__CurrentLocation~0 := ~bvadd32(1bv32, #t~post11); [L244] havoc #t~post11; [L245] #t~post12 := ~Irp__Tail__Overlay__CurrentStackLocation~0; [L245] ~Irp__Tail__Overlay__CurrentStackLocation~0 := ~bvadd32(1bv32, #t~post12); [L245] havoc #t~post12; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L246] CALL call #t~ret13 := IofCallDriver(~devExt__TopOfStack~0, ~Irp); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L480-L552] ~DeviceObject := #in~DeviceObject; [L480-L552] ~Irp := #in~Irp; [L482] havoc ~returnVal2~0; [L483] havoc ~compRetStatus~0; [L484] ~lcontext~0 := #t~nondet30; [L484] havoc #t~nondet30; [L485] havoc ~__cil_tmp7~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L488-L500] COND FALSE !(0bv32 != ~compRegistered~0) VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L501] havoc ~tmp_ndt_6~0; [L502] ~tmp_ndt_6~0 := #t~nondet32; [L502] havoc #t~nondet32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~UNLOADED~0=0bv32] [L503] COND FALSE !(0bv32 == ~tmp_ndt_6~0) [L506] havoc ~tmp_ndt_7~0; [L507] ~tmp_ndt_7~0 := #t~nondet33; [L507] havoc #t~nondet33; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L508] COND TRUE 1bv32 == ~tmp_ndt_7~0 VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L517] ~returnVal2~0 := 3221225473bv32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L527] COND FALSE !(~s~0 == ~NP~0) VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L531] COND FALSE !(~s~0 == ~MPR1~0) VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L540] COND TRUE ~s~0 == ~SKIP1~0 [L541] ~s~0 := ~SKIP2~0; [L542] ~lowerDriverReturn~0 := ~returnVal2~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L550] #res := ~returnVal2~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #res=3221225473bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L246] RET call #t~ret13 := IofCallDriver(~devExt__TopOfStack~0, ~Irp); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #t~ret13=3221225473bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L246] havoc #t~ret13; [L247] ~status~0 := 0bv32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L289] #res := ~status~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #res=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L387] RET call #t~ret27 := KbFilter_PnP(~devobj~0, ~pirp~0); VAL [#t~ret27=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L387] ~status~1 := #t~ret27; [L387] havoc #t~ret27; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L411] COND FALSE !(1bv32 == ~pended~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L419] COND FALSE !(1bv32 == ~pended~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L427] COND TRUE ~s~0 != ~UNLOADED~0 VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L428] COND TRUE 4294967295bv32 != ~status~1 VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L429] COND FALSE !(~s~0 != ~SKIP2~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L439] COND FALSE !(1bv32 == ~pended~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L446] COND FALSE !(~s~0 == ~DC~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L451] COND TRUE ~status~1 != ~lowerDriverReturn~0 VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L452] CALL call errorFn(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L1012] assert false; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L22] int KernelMode ; [L23] int Executive ; [L24] int DevicePowerState ; [L25] int s ; [L26] int UNLOADED ; [L27] int NP ; [L28] int DC ; [L29] int SKIP1 ; [L30] int SKIP2 ; [L31] int MPR1 ; [L32] int MPR3 ; [L33] int IPC ; [L34] int pended ; [L35] int compFptr ; [L36] int compRegistered ; [L37] int lowerDriverReturn ; [L38] int setEventCalled ; [L39] int customIrp ; [L40] int myStatus ; VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=0, DevicePowerState=0, Executive=0, IPC=0, KernelMode=0, lowerDriverReturn=0, MPR1=0, MPR3=0, myStatus=0, NP=0, pended=0, s=0, setEventCalled=0, SKIP1=0, SKIP2=0, UNLOADED=0] [L293] int status ; [L294] int irp = __VERIFIER_nondet_int() ; [L295] int pirp ; [L296] int pirp__IoStatus__Status ; [L297] int irp_choice = __VERIFIER_nondet_int() ; [L298] int devobj = __VERIFIER_nondet_int() ; [L299] int __cil_tmp8 ; [L301] KernelMode = 0 [L302] Executive = 0 [L303] DevicePowerState = 1 [L304] s = 0 [L305] UNLOADED = 0 [L306] NP = 0 [L307] DC = 0 [L308] SKIP1 = 0 [L309] SKIP2 = 0 [L310] MPR1 = 0 [L311] MPR3 = 0 [L312] IPC = 0 [L313] pended = 0 [L314] compFptr = 0 [L315] compRegistered = 0 [L316] lowerDriverReturn = 0 [L317] setEventCalled = 0 [L318] customIrp = 0 [L319] myStatus = 0 [L323] status = 0 [L324] pirp = irp VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=0, DevicePowerState=1, devobj=0, Executive=0, IPC=0, irp=0, irp_choice=1, KernelMode=0, lowerDriverReturn=0, MPR1=0, MPR3=0, myStatus=0, NP=0, pended=0, pirp=0, s=0, setEventCalled=0, SKIP1=0, SKIP2=0, status=0, UNLOADED=0] [L325] CALL _BLAST_init() VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=0, DevicePowerState=1, Executive=0, IPC=0, KernelMode=0, lowerDriverReturn=0, MPR1=0, MPR3=0, myStatus=0, NP=0, pended=0, s=0, setEventCalled=0, SKIP1=0, SKIP2=0, UNLOADED=0] [L60] UNLOADED = 0 [L61] NP = 1 [L62] DC = 2 [L63] SKIP1 = 3 [L64] SKIP2 = 4 [L65] MPR1 = 5 [L66] MPR3 = 6 [L67] IPC = 7 [L68] s = UNLOADED [L69] pended = 0 [L70] compFptr = 0 [L71] compRegistered = 0 [L72] lowerDriverReturn = 0 [L73] setEventCalled = 0 [L74] customIrp = 0 VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, Executive=0, IPC=7, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=0, setEventCalled=0, SKIP1=3, SKIP2=4, UNLOADED=0] [L325] RET _BLAST_init() VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, devobj=0, Executive=0, IPC=7, irp=0, irp_choice=1, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, pirp=0, s=0, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, UNLOADED=0] [L327] COND TRUE status >= 0 [L328] s = NP [L329] customIrp = 0 [L330] setEventCalled = customIrp [L331] lowerDriverReturn = setEventCalled [L332] compRegistered = lowerDriverReturn [L333] pended = compRegistered [L334] pirp__IoStatus__Status = 0 [L335] myStatus = 0 VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, devobj=0, Executive=0, IPC=7, irp=0, irp_choice=1, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, pirp=0, pirp__IoStatus__Status=0, s=1, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, UNLOADED=0] [L336] COND FALSE !(irp_choice == 0) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, devobj=0, Executive=0, IPC=7, irp=0, irp_choice=1, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, pirp=0, pirp__IoStatus__Status=0, s=1, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, UNLOADED=0] [L341] CALL stub_driver_init() VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=1, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, Executive=0, IPC=7, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=1, setEventCalled=0, SKIP1=3, SKIP2=4, UNLOADED=0] [L46] s = NP [L47] pended = 0 [L48] compFptr = 0 [L49] compRegistered = 0 [L50] lowerDriverReturn = 0 [L51] setEventCalled = 0 [L52] customIrp = 0 VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=1, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, Executive=0, IPC=7, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=1, setEventCalled=0, SKIP1=3, SKIP2=4, UNLOADED=0] [L341] RET stub_driver_init() VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, devobj=0, Executive=0, IPC=7, irp=0, irp_choice=1, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, pirp=0, pirp__IoStatus__Status=0, s=1, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, UNLOADED=0] [L344] COND FALSE !(status < 0) [L348] int tmp_ndt_1; [L349] tmp_ndt_1 = __VERIFIER_nondet_int() [L350] COND FALSE !(tmp_ndt_1 == 0) [L353] int tmp_ndt_2; [L354] tmp_ndt_2 = __VERIFIER_nondet_int() [L355] COND FALSE !(tmp_ndt_2 == 1) [L358] int tmp_ndt_3; [L359] tmp_ndt_3 = __VERIFIER_nondet_int() [L360] COND TRUE tmp_ndt_3 == 3 VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, devobj=0, Executive=0, IPC=7, irp=0, irp_choice=1, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, pirp=0, pirp__IoStatus__Status=0, s=1, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, tmp_ndt_1=1, tmp_ndt_2=0, tmp_ndt_3=3, UNLOADED=0] [L387] CALL, EXPR KbFilter_PnP(devobj, pirp) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=1, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, Executive=0, IPC=7, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=1, setEventCalled=0, SKIP1=3, SKIP2=4, UNLOADED=0] [L79] int devExt ; [L80] int irpStack ; [L81] int status ; [L82] int event = __VERIFIER_nondet_int() ; [L83] int DeviceObject__DeviceExtension = __VERIFIER_nondet_int() ; [L84] int Irp__Tail__Overlay__CurrentStackLocation = __VERIFIER_nondet_int() ; [L85] int irpStack__MinorFunction = __VERIFIER_nondet_int() ; [L86] int devExt__TopOfStack = __VERIFIER_nondet_int() ; [L87] int devExt__Started ; [L88] int devExt__Removed ; [L89] int devExt__SurpriseRemoved ; [L90] int Irp__IoStatus__Status ; [L91] int Irp__IoStatus__Information ; [L92] int Irp__CurrentLocation = __VERIFIER_nondet_int() ; [L93] int irpSp ; [L94] int nextIrpSp ; [L95] int nextIrpSp__Control ; [L96] int irpSp___0 ; [L97] int irpSp__Context ; [L98] int irpSp__Control ; [L99] long __cil_tmp23 ; [L102] status = 0 [L103] devExt = DeviceObject__DeviceExtension [L104] irpStack = Irp__Tail__Overlay__CurrentStackLocation VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=1, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, devExt=0, devExt__TopOfStack=0, DeviceObject=0, DeviceObject__DeviceExtension=0, DevicePowerState=1, event=0, Executive=0, IPC=7, Irp=0, Irp__CurrentLocation=2147483647, Irp__Tail__Overlay__CurrentStackLocation=2147483647, irpStack=2147483647, irpStack__MinorFunction=2, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=1, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, UNLOADED=0] [L105] COND FALSE !(irpStack__MinorFunction == 0) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=1, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, devExt=0, devExt__TopOfStack=0, DeviceObject=0, DeviceObject__DeviceExtension=0, DevicePowerState=1, event=0, Executive=0, IPC=7, Irp=0, Irp__CurrentLocation=2147483647, Irp__Tail__Overlay__CurrentStackLocation=2147483647, irpStack=2147483647, irpStack__MinorFunction=2, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=1, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, UNLOADED=0] [L108] COND FALSE !(irpStack__MinorFunction == 23) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=1, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, devExt=0, devExt__TopOfStack=0, DeviceObject=0, DeviceObject__DeviceExtension=0, DevicePowerState=1, event=0, Executive=0, IPC=7, Irp=0, Irp__CurrentLocation=2147483647, Irp__Tail__Overlay__CurrentStackLocation=2147483647, irpStack=2147483647, irpStack__MinorFunction=2, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=1, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, UNLOADED=0] [L111] COND TRUE irpStack__MinorFunction == 2 VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=1, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, devExt=0, devExt__TopOfStack=0, DeviceObject=0, DeviceObject__DeviceExtension=0, DevicePowerState=1, event=0, Executive=0, IPC=7, Irp=0, Irp__CurrentLocation=2147483647, Irp__Tail__Overlay__CurrentStackLocation=2147483647, irpStack=2147483647, irpStack__MinorFunction=2, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=1, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, UNLOADED=0] [L235] devExt__Removed = 1 VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=1, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, devExt=0, devExt__Removed=1, devExt__TopOfStack=0, DeviceObject=0, DeviceObject__DeviceExtension=0, DevicePowerState=1, event=0, Executive=0, IPC=7, Irp=0, Irp__CurrentLocation=2147483647, Irp__Tail__Overlay__CurrentStackLocation=2147483647, irpStack=2147483647, irpStack__MinorFunction=2, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=1, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, UNLOADED=0] [L236] COND TRUE s == NP [L237] s = SKIP1 VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=1, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, devExt=0, devExt__Removed=1, devExt__TopOfStack=0, DeviceObject=0, DeviceObject__DeviceExtension=0, DevicePowerState=1, event=0, Executive=0, IPC=7, Irp=0, Irp__CurrentLocation=2147483647, Irp__Tail__Overlay__CurrentStackLocation=2147483647, irpStack=2147483647, irpStack__MinorFunction=2, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=3, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, UNLOADED=0] [L244] Irp__CurrentLocation ++ [L245] Irp__Tail__Overlay__CurrentStackLocation ++ VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=1, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, devExt=0, devExt__Removed=1, devExt__TopOfStack=0, DeviceObject=0, DeviceObject__DeviceExtension=0, DevicePowerState=1, event=0, Executive=0, IPC=7, Irp=0, Irp__CurrentLocation=2147483648, Irp__Tail__Overlay__CurrentStackLocation=2147483648, irpStack=2147483647, irpStack__MinorFunction=2, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=3, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, UNLOADED=0] [L246] CALL IofCallDriver(devExt__TopOfStack, Irp) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=3, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, Executive=0, IPC=7, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=3, setEventCalled=0, SKIP1=3, SKIP2=4, UNLOADED=0] [L482] int returnVal2 ; [L483] int compRetStatus ; [L484] int lcontext = __VERIFIER_nondet_int() ; [L485] long long __cil_tmp7 ; VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=3, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DeviceObject=0, DevicePowerState=1, Executive=0, IPC=7, Irp=0, KernelMode=0, lcontext=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=3, setEventCalled=0, SKIP1=3, SKIP2=4, UNLOADED=0] [L488] COND FALSE !(\read(compRegistered)) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=3, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DeviceObject=0, DevicePowerState=1, Executive=0, IPC=7, Irp=0, KernelMode=0, lcontext=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=3, setEventCalled=0, SKIP1=3, SKIP2=4, UNLOADED=0] [L501] int tmp_ndt_6; [L502] tmp_ndt_6 = __VERIFIER_nondet_int() [L503] COND FALSE !(tmp_ndt_6 == 0) [L506] int tmp_ndt_7; [L507] tmp_ndt_7 = __VERIFIER_nondet_int() [L508] COND TRUE tmp_ndt_7 == 1 VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=3, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DeviceObject=0, DevicePowerState=1, Executive=0, IPC=7, Irp=0, KernelMode=0, lcontext=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=3, setEventCalled=0, SKIP1=3, SKIP2=4, tmp_ndt_6=1, tmp_ndt_7=1, UNLOADED=0] [L517] returnVal2 = -1073741823 VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=3, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DeviceObject=0, DevicePowerState=1, Executive=0, IPC=7, Irp=0, KernelMode=0, lcontext=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, returnVal2=3221225473, s=3, setEventCalled=0, SKIP1=3, SKIP2=4, tmp_ndt_6=1, tmp_ndt_7=1, UNLOADED=0] [L527] COND FALSE !(s == NP) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=3, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DeviceObject=0, DevicePowerState=1, Executive=0, IPC=7, Irp=0, KernelMode=0, lcontext=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, returnVal2=3221225473, s=3, setEventCalled=0, SKIP1=3, SKIP2=4, tmp_ndt_6=1, tmp_ndt_7=1, UNLOADED=0] [L531] COND FALSE !(s == MPR1) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=3, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DeviceObject=0, DevicePowerState=1, Executive=0, IPC=7, Irp=0, KernelMode=0, lcontext=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, returnVal2=3221225473, s=3, setEventCalled=0, SKIP1=3, SKIP2=4, tmp_ndt_6=1, tmp_ndt_7=1, UNLOADED=0] [L540] COND TRUE s == SKIP1 [L541] s = SKIP2 [L542] lowerDriverReturn = returnVal2 VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=3, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DeviceObject=0, DevicePowerState=1, Executive=0, IPC=7, Irp=0, KernelMode=0, lcontext=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, returnVal2=3221225473, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, tmp_ndt_6=1, tmp_ndt_7=1, UNLOADED=0] [L550] return (returnVal2); VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=3, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, \result=-1073741823, compFptr=0, compRegistered=0, customIrp=0, DC=2, DeviceObject=0, DevicePowerState=1, Executive=0, IPC=7, Irp=0, KernelMode=0, lcontext=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, returnVal2=3221225473, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, tmp_ndt_6=1, tmp_ndt_7=1, UNLOADED=0] [L246] RET IofCallDriver(devExt__TopOfStack, Irp) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=1, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, devExt=0, devExt__Removed=1, devExt__TopOfStack=0, DeviceObject=0, DeviceObject__DeviceExtension=0, DevicePowerState=1, event=0, Executive=0, IofCallDriver(devExt__TopOfStack, Irp)=-1073741823, IPC=7, Irp=0, Irp__CurrentLocation=2147483648, Irp__Tail__Overlay__CurrentStackLocation=2147483648, irpStack=2147483647, irpStack__MinorFunction=2, KernelMode=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, UNLOADED=0] [L247] status = 0 VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=1, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, devExt=0, devExt__Removed=1, devExt__TopOfStack=0, DeviceObject=0, DeviceObject__DeviceExtension=0, DevicePowerState=1, event=0, Executive=0, IPC=7, Irp=0, Irp__CurrentLocation=2147483648, Irp__Tail__Overlay__CurrentStackLocation=2147483648, irpStack=2147483647, irpStack__MinorFunction=2, KernelMode=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, UNLOADED=0] [L289] return (status); VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=1, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, \result=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, devExt=0, devExt__Removed=1, devExt__TopOfStack=0, DeviceObject=0, DeviceObject__DeviceExtension=0, DevicePowerState=1, event=0, Executive=0, IPC=7, Irp=0, Irp__CurrentLocation=2147483648, Irp__Tail__Overlay__CurrentStackLocation=2147483648, irpStack=2147483647, irpStack__MinorFunction=2, KernelMode=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, UNLOADED=0] [L387] RET, EXPR KbFilter_PnP(devobj, pirp) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, devobj=0, Executive=0, IPC=7, irp=0, irp_choice=1, KbFilter_PnP(devobj, pirp)=0, KernelMode=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, pirp=0, pirp__IoStatus__Status=0, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, tmp_ndt_1=1, tmp_ndt_2=0, tmp_ndt_3=3, UNLOADED=0] [L387] status = KbFilter_PnP(devobj, pirp) [L411] COND FALSE !(pended == 1) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, devobj=0, Executive=0, IPC=7, irp=0, irp_choice=1, KernelMode=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, pirp=0, pirp__IoStatus__Status=0, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, tmp_ndt_1=1, tmp_ndt_2=0, tmp_ndt_3=3, UNLOADED=0] [L419] COND FALSE !(pended == 1) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, devobj=0, Executive=0, IPC=7, irp=0, irp_choice=1, KernelMode=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, pirp=0, pirp__IoStatus__Status=0, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, tmp_ndt_1=1, tmp_ndt_2=0, tmp_ndt_3=3, UNLOADED=0] [L427] COND TRUE s != UNLOADED VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, devobj=0, Executive=0, IPC=7, irp=0, irp_choice=1, KernelMode=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, pirp=0, pirp__IoStatus__Status=0, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, tmp_ndt_1=1, tmp_ndt_2=0, tmp_ndt_3=3, UNLOADED=0] [L428] COND TRUE status != -1 VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, devobj=0, Executive=0, IPC=7, irp=0, irp_choice=1, KernelMode=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, pirp=0, pirp__IoStatus__Status=0, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, tmp_ndt_1=1, tmp_ndt_2=0, tmp_ndt_3=3, UNLOADED=0] [L429] COND FALSE !(s != SKIP2) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, devobj=0, Executive=0, IPC=7, irp=0, irp_choice=1, KernelMode=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, pirp=0, pirp__IoStatus__Status=0, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, tmp_ndt_1=1, tmp_ndt_2=0, tmp_ndt_3=3, UNLOADED=0] [L439] COND FALSE !(pended == 1) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, devobj=0, Executive=0, IPC=7, irp=0, irp_choice=1, KernelMode=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, pirp=0, pirp__IoStatus__Status=0, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, tmp_ndt_1=1, tmp_ndt_2=0, tmp_ndt_3=3, UNLOADED=0] [L446] COND FALSE !(s == DC) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, devobj=0, Executive=0, IPC=7, irp=0, irp_choice=1, KernelMode=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, pirp=0, pirp__IoStatus__Status=0, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, tmp_ndt_1=1, tmp_ndt_2=0, tmp_ndt_3=3, UNLOADED=0] [L451] COND TRUE status != lowerDriverReturn VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, devobj=0, Executive=0, IPC=7, irp=0, irp_choice=1, KernelMode=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, pirp=0, pirp__IoStatus__Status=0, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, tmp_ndt_1=1, tmp_ndt_2=0, tmp_ndt_3=3, UNLOADED=0] [L452] CALL errorFn() VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, Executive=0, IPC=7, KernelMode=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, UNLOADED=0] [L1012] __VERIFIER_error() VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, Executive=0, IPC=7, KernelMode=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, UNLOADED=0] ----- [2018-11-23 10:49:43,742 WARN L170 areAnnotationChecker]: KeSetEventENTRY has no Hoare annotation [2018-11-23 10:49:43,742 WARN L170 areAnnotationChecker]: KbFilter_CompleteENTRY has no Hoare annotation [2018-11-23 10:49:43,743 WARN L170 areAnnotationChecker]: KbFilter_PowerENTRY has no Hoare annotation [2018-11-23 10:49:43,743 WARN L170 areAnnotationChecker]: stub_driver_initENTRY has no Hoare annotation [2018-11-23 10:49:43,743 WARN L170 areAnnotationChecker]: _BLAST_initENTRY has no Hoare annotation [2018-11-23 10:49:43,743 WARN L170 areAnnotationChecker]: errorFnENTRY has no Hoare annotation [2018-11-23 10:49:43,743 WARN L170 areAnnotationChecker]: errorFnENTRY has no Hoare annotation [2018-11-23 10:49:43,743 WARN L170 areAnnotationChecker]: mainENTRY has no Hoare annotation [2018-11-23 10:49:43,743 WARN L170 areAnnotationChecker]: IofCallDriverENTRY has no Hoare annotation [2018-11-23 10:49:43,743 WARN L170 areAnnotationChecker]: stubMoreProcessingRequiredENTRY has no Hoare annotation [2018-11-23 10:49:43,743 WARN L170 areAnnotationChecker]: stubMoreProcessingRequiredENTRY has no Hoare annotation [2018-11-23 10:49:43,743 WARN L170 areAnnotationChecker]: PoCallDriverENTRY has no Hoare annotation [2018-11-23 10:49:43,744 WARN L170 areAnnotationChecker]: KbFilter_CreateCloseENTRY has no Hoare annotation [2018-11-23 10:49:43,744 WARN L170 areAnnotationChecker]: ULTIMATE.initENTRY has no Hoare annotation [2018-11-23 10:49:43,744 WARN L170 areAnnotationChecker]: KbFilter_InternIoCtlENTRY has no Hoare annotation [2018-11-23 10:49:43,744 WARN L170 areAnnotationChecker]: KeWaitForSingleObjectENTRY has no Hoare annotation [2018-11-23 10:49:43,744 WARN L170 areAnnotationChecker]: IofCompleteRequestENTRY has no Hoare annotation [2018-11-23 10:49:43,744 WARN L170 areAnnotationChecker]: ULTIMATE.startENTRY has no Hoare annotation [2018-11-23 10:49:43,744 WARN L170 areAnnotationChecker]: ULTIMATE.startENTRY has no Hoare annotation [2018-11-23 10:49:43,744 WARN L170 areAnnotationChecker]: KbFilter_DispatchPassThroughENTRY has no Hoare annotation [2018-11-23 10:49:43,744 WARN L170 areAnnotationChecker]: KbFilter_PnPENTRY has no Hoare annotation [2018-11-23 10:49:43,744 WARN L170 areAnnotationChecker]: KeSetEventFINAL has no Hoare annotation [2018-11-23 10:49:43,745 WARN L170 areAnnotationChecker]: L623 has no Hoare annotation [2018-11-23 10:49:43,745 WARN L170 areAnnotationChecker]: L623 has no Hoare annotation [2018-11-23 10:49:43,745 WARN L170 areAnnotationChecker]: L699 has no Hoare annotation [2018-11-23 10:49:43,745 WARN L170 areAnnotationChecker]: L699 has no Hoare annotation [2018-11-23 10:49:43,745 WARN L170 areAnnotationChecker]: stub_driver_initFINAL has no Hoare annotation [2018-11-23 10:49:43,745 WARN L170 areAnnotationChecker]: _BLAST_initFINAL has no Hoare annotation [2018-11-23 10:49:43,745 WARN L170 areAnnotationChecker]: errorFnFINAL has no Hoare annotation [2018-11-23 10:49:43,745 WARN L170 areAnnotationChecker]: L325 has no Hoare annotation [2018-11-23 10:49:43,745 WARN L170 areAnnotationChecker]: L325 has no Hoare annotation [2018-11-23 10:49:43,746 WARN L170 areAnnotationChecker]: L488 has no Hoare annotation [2018-11-23 10:49:43,746 WARN L170 areAnnotationChecker]: L488 has no Hoare annotation [2018-11-23 10:49:43,746 WARN L170 areAnnotationChecker]: L474-1 has no Hoare annotation [2018-11-23 10:49:43,746 WARN L170 areAnnotationChecker]: L474 has no Hoare annotation [2018-11-23 10:49:43,746 WARN L170 areAnnotationChecker]: L474 has no Hoare annotation [2018-11-23 10:49:43,746 WARN L170 areAnnotationChecker]: L753 has no Hoare annotation [2018-11-23 10:49:43,746 WARN L170 areAnnotationChecker]: L753 has no Hoare annotation [2018-11-23 10:49:43,746 WARN L170 areAnnotationChecker]: L637 has no Hoare annotation [2018-11-23 10:49:43,746 WARN L170 areAnnotationChecker]: L637 has no Hoare annotation [2018-11-23 10:49:43,746 WARN L170 areAnnotationChecker]: ULTIMATE.initFINAL has no Hoare annotation [2018-11-23 10:49:43,747 WARN L170 areAnnotationChecker]: L874 has no Hoare annotation [2018-11-23 10:49:43,747 WARN L170 areAnnotationChecker]: L874 has no Hoare annotation [2018-11-23 10:49:43,747 WARN L170 areAnnotationChecker]: L580 has no Hoare annotation [2018-11-23 10:49:43,747 WARN L170 areAnnotationChecker]: L580 has no Hoare annotation [2018-11-23 10:49:43,747 WARN L170 areAnnotationChecker]: L557 has no Hoare annotation [2018-11-23 10:49:43,747 WARN L170 areAnnotationChecker]: L557 has no Hoare annotation [2018-11-23 10:49:43,747 WARN L170 areAnnotationChecker]: L-1 has no Hoare annotation [2018-11-23 10:49:43,747 WARN L170 areAnnotationChecker]: L-1 has no Hoare annotation [2018-11-23 10:49:43,747 WARN L170 areAnnotationChecker]: L673 has no Hoare annotation [2018-11-23 10:49:43,747 WARN L170 areAnnotationChecker]: L673 has no Hoare annotation [2018-11-23 10:49:43,748 WARN L170 areAnnotationChecker]: L105 has no Hoare annotation [2018-11-23 10:49:43,748 WARN L170 areAnnotationChecker]: L105 has no Hoare annotation [2018-11-23 10:49:43,749 WARN L170 areAnnotationChecker]: KeSetEventEXIT has no Hoare annotation [2018-11-23 10:49:43,749 WARN L170 areAnnotationChecker]: L623-1 has no Hoare annotation [2018-11-23 10:49:43,749 WARN L170 areAnnotationChecker]: L700 has no Hoare annotation [2018-11-23 10:49:43,749 WARN L170 areAnnotationChecker]: L700 has no Hoare annotation [2018-11-23 10:49:43,749 WARN L170 areAnnotationChecker]: L702 has no Hoare annotation [2018-11-23 10:49:43,749 WARN L170 areAnnotationChecker]: L702 has no Hoare annotation [2018-11-23 10:49:43,749 WARN L170 areAnnotationChecker]: stub_driver_initEXIT has no Hoare annotation [2018-11-23 10:49:43,749 WARN L170 areAnnotationChecker]: _BLAST_initEXIT has no Hoare annotation [2018-11-23 10:49:43,749 WARN L170 areAnnotationChecker]: errorFnEXIT has no Hoare annotation [2018-11-23 10:49:43,749 WARN L170 areAnnotationChecker]: errorFnEXIT has no Hoare annotation [2018-11-23 10:49:43,750 WARN L170 areAnnotationChecker]: errorFnEXIT has no Hoare annotation [2018-11-23 10:49:43,750 WARN L170 areAnnotationChecker]: errorFnEXIT has no Hoare annotation [2018-11-23 10:49:43,750 WARN L170 areAnnotationChecker]: errorFnEXIT has no Hoare annotation [2018-11-23 10:49:43,750 WARN L170 areAnnotationChecker]: errorFnEXIT has no Hoare annotation [2018-11-23 10:49:43,750 WARN L170 areAnnotationChecker]: errorFnEXIT has no Hoare annotation [2018-11-23 10:49:43,750 WARN L170 areAnnotationChecker]: errorFnEXIT has no Hoare annotation [2018-11-23 10:49:43,750 WARN L170 areAnnotationChecker]: errorFnEXIT has no Hoare annotation [2018-11-23 10:49:43,750 WARN L170 areAnnotationChecker]: errorFnEXIT has no Hoare annotation [2018-11-23 10:49:43,750 WARN L170 areAnnotationChecker]: errorFnEXIT has no Hoare annotation [2018-11-23 10:49:43,750 WARN L170 areAnnotationChecker]: errorFnEXIT has no Hoare annotation [2018-11-23 10:49:43,750 WARN L170 areAnnotationChecker]: errorFnEXIT has no Hoare annotation [2018-11-23 10:49:43,751 WARN L170 areAnnotationChecker]: errorFnEXIT has no Hoare annotation [2018-11-23 10:49:43,751 WARN L170 areAnnotationChecker]: L325-1 has no Hoare annotation [2018-11-23 10:49:43,751 WARN L170 areAnnotationChecker]: L325-1 has no Hoare annotation [2018-11-23 10:49:43,751 WARN L170 areAnnotationChecker]: L490 has no Hoare annotation [2018-11-23 10:49:43,751 WARN L170 areAnnotationChecker]: L490 has no Hoare annotation [2018-11-23 10:49:43,751 WARN L170 areAnnotationChecker]: L488-1 has no Hoare annotation [2018-11-23 10:49:43,751 WARN L170 areAnnotationChecker]: stubMoreProcessingRequiredEXIT has no Hoare annotation [2018-11-23 10:49:43,751 WARN L170 areAnnotationChecker]: stubMoreProcessingRequiredEXIT has no Hoare annotation [2018-11-23 10:49:43,751 WARN L170 areAnnotationChecker]: L755 has no Hoare annotation [2018-11-23 10:49:43,751 WARN L170 areAnnotationChecker]: L755 has no Hoare annotation [2018-11-23 10:49:43,752 WARN L170 areAnnotationChecker]: L753-1 has no Hoare annotation [2018-11-23 10:49:43,752 WARN L170 areAnnotationChecker]: L644 has no Hoare annotation [2018-11-23 10:49:43,752 WARN L170 areAnnotationChecker]: L644 has no Hoare annotation [2018-11-23 10:49:43,752 WARN L170 areAnnotationChecker]: L640 has no Hoare annotation [2018-11-23 10:49:43,752 WARN L170 areAnnotationChecker]: L640 has no Hoare annotation [2018-11-23 10:49:43,752 WARN L170 areAnnotationChecker]: ULTIMATE.initEXIT has no Hoare annotation [2018-11-23 10:49:43,752 WARN L170 areAnnotationChecker]: L934 has no Hoare annotation [2018-11-23 10:49:43,752 WARN L170 areAnnotationChecker]: L934 has no Hoare annotation [2018-11-23 10:49:43,752 WARN L170 areAnnotationChecker]: L882 has no Hoare annotation [2018-11-23 10:49:43,752 WARN L170 areAnnotationChecker]: L882 has no Hoare annotation [2018-11-23 10:49:43,753 WARN L170 areAnnotationChecker]: L581 has no Hoare annotation [2018-11-23 10:49:43,753 WARN L170 areAnnotationChecker]: L581 has no Hoare annotation [2018-11-23 10:49:43,753 WARN L170 areAnnotationChecker]: L588 has no Hoare annotation [2018-11-23 10:49:43,753 WARN L170 areAnnotationChecker]: L588 has no Hoare annotation [2018-11-23 10:49:43,753 WARN L170 areAnnotationChecker]: L561-1 has no Hoare annotation [2018-11-23 10:49:43,753 WARN L170 areAnnotationChecker]: L561 has no Hoare annotation [2018-11-23 10:49:43,754 WARN L170 areAnnotationChecker]: L561 has no Hoare annotation [2018-11-23 10:49:43,754 WARN L170 areAnnotationChecker]: ULTIMATE.startFINAL has no Hoare annotation [2018-11-23 10:49:43,754 WARN L170 areAnnotationChecker]: L677-1 has no Hoare annotation [2018-11-23 10:49:43,754 WARN L170 areAnnotationChecker]: L677 has no Hoare annotation [2018-11-23 10:49:43,754 WARN L170 areAnnotationChecker]: L677 has no Hoare annotation [2018-11-23 10:49:43,754 WARN L170 areAnnotationChecker]: L106 has no Hoare annotation [2018-11-23 10:49:43,754 WARN L170 areAnnotationChecker]: L108 has no Hoare annotation [2018-11-23 10:49:43,754 WARN L170 areAnnotationChecker]: L108 has no Hoare annotation [2018-11-23 10:49:43,754 WARN L170 areAnnotationChecker]: KbFilter_CompleteFINAL has no Hoare annotation [2018-11-23 10:49:43,754 WARN L170 areAnnotationChecker]: L723 has no Hoare annotation [2018-11-23 10:49:43,755 WARN L170 areAnnotationChecker]: L723 has no Hoare annotation [2018-11-23 10:49:43,755 WARN L170 areAnnotationChecker]: L705 has no Hoare annotation [2018-11-23 10:49:43,755 WARN L170 areAnnotationChecker]: L705 has no Hoare annotation [2018-11-23 10:49:43,755 WARN L170 areAnnotationChecker]: L341 has no Hoare annotation [2018-11-23 10:49:43,755 WARN L170 areAnnotationChecker]: L341 has no Hoare annotation [2018-11-23 10:49:43,755 WARN L170 areAnnotationChecker]: L733-1 has no Hoare annotation [2018-11-23 10:49:43,755 WARN L170 areAnnotationChecker]: L427 has no Hoare annotation [2018-11-23 10:49:43,755 WARN L170 areAnnotationChecker]: L545-1 has no Hoare annotation [2018-11-23 10:49:43,755 WARN L170 areAnnotationChecker]: L813-1 has no Hoare annotation [2018-11-23 10:49:43,755 WARN L170 areAnnotationChecker]: L593-1 has no Hoare annotation [2018-11-23 10:49:43,755 WARN L170 areAnnotationChecker]: L179-1 has no Hoare annotation [2018-11-23 10:49:43,756 WARN L170 areAnnotationChecker]: L224-1 has no Hoare annotation [2018-11-23 10:49:43,756 WARN L170 areAnnotationChecker]: L240-1 has no Hoare annotation [2018-11-23 10:49:43,756 WARN L170 areAnnotationChecker]: L255-1 has no Hoare annotation [2018-11-23 10:49:43,756 WARN L170 areAnnotationChecker]: L336 has no Hoare annotation [2018-11-23 10:49:43,756 WARN L170 areAnnotationChecker]: L336 has no Hoare annotation [2018-11-23 10:49:43,756 WARN L170 areAnnotationChecker]: L327 has no Hoare annotation [2018-11-23 10:49:43,756 WARN L170 areAnnotationChecker]: L327 has no Hoare annotation [2018-11-23 10:49:43,756 WARN L170 areAnnotationChecker]: L490-1 has no Hoare annotation [2018-11-23 10:49:43,756 WARN L170 areAnnotationChecker]: L503 has no Hoare annotation [2018-11-23 10:49:43,756 WARN L170 areAnnotationChecker]: L503 has no Hoare annotation [2018-11-23 10:49:43,757 WARN L170 areAnnotationChecker]: L755-1 has no Hoare annotation [2018-11-23 10:49:43,757 WARN L170 areAnnotationChecker]: L768 has no Hoare annotation [2018-11-23 10:49:43,757 WARN L170 areAnnotationChecker]: L768 has no Hoare annotation [2018-11-23 10:49:43,757 WARN L170 areAnnotationChecker]: L652 has no Hoare annotation [2018-11-23 10:49:43,757 WARN L170 areAnnotationChecker]: L643 has no Hoare annotation [2018-11-23 10:49:43,757 WARN L170 areAnnotationChecker]: L643 has no Hoare annotation [2018-11-23 10:49:43,757 WARN L170 areAnnotationChecker]: L971 has no Hoare annotation [2018-11-23 10:49:43,757 WARN L170 areAnnotationChecker]: L971 has no Hoare annotation [2018-11-23 10:49:43,757 WARN L170 areAnnotationChecker]: L939 has no Hoare annotation [2018-11-23 10:49:43,757 WARN L170 areAnnotationChecker]: L939 has no Hoare annotation [2018-11-23 10:49:43,758 WARN L170 areAnnotationChecker]: L883 has no Hoare annotation [2018-11-23 10:49:43,758 WARN L170 areAnnotationChecker]: L890 has no Hoare annotation [2018-11-23 10:49:43,758 WARN L170 areAnnotationChecker]: L890 has no Hoare annotation [2018-11-23 10:49:43,758 WARN L170 areAnnotationChecker]: L593 has no Hoare annotation [2018-11-23 10:49:43,758 WARN L170 areAnnotationChecker]: L593 has no Hoare annotation [2018-11-23 10:49:43,758 WARN L170 areAnnotationChecker]: IofCompleteRequestEXIT has no Hoare annotation [2018-11-23 10:49:43,758 WARN L170 areAnnotationChecker]: IofCompleteRequestEXIT has no Hoare annotation [2018-11-23 10:49:43,758 WARN L170 areAnnotationChecker]: L683 has no Hoare annotation [2018-11-23 10:49:43,758 WARN L170 areAnnotationChecker]: L683 has no Hoare annotation [2018-11-23 10:49:43,758 WARN L170 areAnnotationChecker]: L174 has no Hoare annotation [2018-11-23 10:49:43,759 WARN L170 areAnnotationChecker]: L174 has no Hoare annotation [2018-11-23 10:49:43,759 WARN L170 areAnnotationChecker]: L109 has no Hoare annotation [2018-11-23 10:49:43,759 WARN L170 areAnnotationChecker]: L111 has no Hoare annotation [2018-11-23 10:49:43,759 WARN L170 areAnnotationChecker]: L111 has no Hoare annotation [2018-11-23 10:49:43,759 WARN L170 areAnnotationChecker]: KbFilter_CompleteEXIT has no Hoare annotation [2018-11-23 10:49:43,759 WARN L170 areAnnotationChecker]: KbFilter_CompleteEXIT has no Hoare annotation [2018-11-23 10:49:43,759 WARN L170 areAnnotationChecker]: L733 has no Hoare annotation [2018-11-23 10:49:43,759 WARN L170 areAnnotationChecker]: L733 has no Hoare annotation [2018-11-23 10:49:43,759 WARN L170 areAnnotationChecker]: L708 has no Hoare annotation [2018-11-23 10:49:43,759 WARN L170 areAnnotationChecker]: L708 has no Hoare annotation [2018-11-23 10:49:43,760 WARN L170 areAnnotationChecker]: mainFINAL has no Hoare annotation [2018-11-23 10:49:43,760 WARN L170 areAnnotationChecker]: L350 has no Hoare annotation [2018-11-23 10:49:43,760 WARN L170 areAnnotationChecker]: L350 has no Hoare annotation [2018-11-23 10:49:43,760 WARN L170 areAnnotationChecker]: L739 has no Hoare annotation [2018-11-23 10:49:43,760 WARN L170 areAnnotationChecker]: L739 has no Hoare annotation [2018-11-23 10:49:43,760 WARN L170 areAnnotationChecker]: IofCallDriverFINAL has no Hoare annotation [2018-11-23 10:49:43,760 WARN L170 areAnnotationChecker]: PoCallDriverFINAL has no Hoare annotation [2018-11-23 10:49:43,760 WARN L170 areAnnotationChecker]: L602 has no Hoare annotation [2018-11-23 10:49:43,760 WARN L170 areAnnotationChecker]: L602 has no Hoare annotation [2018-11-23 10:49:43,760 WARN L170 areAnnotationChecker]: L191 has no Hoare annotation [2018-11-23 10:49:43,761 WARN L170 areAnnotationChecker]: L191 has no Hoare annotation [2018-11-23 10:49:43,761 WARN L170 areAnnotationChecker]: L230 has no Hoare annotation [2018-11-23 10:49:43,761 WARN L170 areAnnotationChecker]: L230 has no Hoare annotation [2018-11-23 10:49:43,761 WARN L170 areAnnotationChecker]: L246 has no Hoare annotation [2018-11-23 10:49:43,761 WARN L170 areAnnotationChecker]: L246 has no Hoare annotation [2018-11-23 10:49:43,761 WARN L170 areAnnotationChecker]: L261 has no Hoare annotation [2018-11-23 10:49:43,761 WARN L170 areAnnotationChecker]: L261 has no Hoare annotation [2018-11-23 10:49:43,761 WARN L170 areAnnotationChecker]: L336-2 has no Hoare annotation [2018-11-23 10:49:43,761 WARN L170 areAnnotationChecker]: L336-2 has no Hoare annotation [2018-11-23 10:49:43,761 WARN L170 areAnnotationChecker]: L412 has no Hoare annotation [2018-11-23 10:49:43,762 WARN L170 areAnnotationChecker]: L412 has no Hoare annotation [2018-11-23 10:49:43,762 WARN L170 areAnnotationChecker]: L418 has no Hoare annotation [2018-11-23 10:49:43,762 WARN L170 areAnnotationChecker]: L418 has no Hoare annotation [2018-11-23 10:49:43,762 WARN L170 areAnnotationChecker]: L494 has no Hoare annotation [2018-11-23 10:49:43,762 WARN L170 areAnnotationChecker]: L494 has no Hoare annotation [2018-11-23 10:49:43,762 WARN L170 areAnnotationChecker]: L504 has no Hoare annotation [2018-11-23 10:49:43,762 WARN L170 areAnnotationChecker]: L508 has no Hoare annotation [2018-11-23 10:49:43,762 WARN L170 areAnnotationChecker]: L508 has no Hoare annotation [2018-11-23 10:49:43,762 WARN L170 areAnnotationChecker]: L759 has no Hoare annotation [2018-11-23 10:49:43,762 WARN L170 areAnnotationChecker]: L759 has no Hoare annotation [2018-11-23 10:49:43,762 WARN L170 areAnnotationChecker]: L769 has no Hoare annotation [2018-11-23 10:49:43,763 WARN L170 areAnnotationChecker]: L773 has no Hoare annotation [2018-11-23 10:49:43,763 WARN L170 areAnnotationChecker]: L773 has no Hoare annotation [2018-11-23 10:49:43,763 WARN L170 areAnnotationChecker]: L659 has no Hoare annotation [2018-11-23 10:49:43,763 WARN L170 areAnnotationChecker]: L659 has no Hoare annotation [2018-11-23 10:49:43,763 WARN L170 areAnnotationChecker]: L996 has no Hoare annotation [2018-11-23 10:49:43,763 WARN L170 areAnnotationChecker]: L996 has no Hoare annotation [2018-11-23 10:49:43,763 WARN L170 areAnnotationChecker]: L1002 has no Hoare annotation [2018-11-23 10:49:43,763 WARN L170 areAnnotationChecker]: L1002 has no Hoare annotation [2018-11-23 10:49:43,763 WARN L170 areAnnotationChecker]: L891 has no Hoare annotation [2018-11-23 10:49:43,763 WARN L170 areAnnotationChecker]: L891 has no Hoare annotation [2018-11-23 10:49:43,763 WARN L170 areAnnotationChecker]: L895 has no Hoare annotation [2018-11-23 10:49:43,764 WARN L170 areAnnotationChecker]: L895 has no Hoare annotation [2018-11-23 10:49:43,764 WARN L170 areAnnotationChecker]: L595 has no Hoare annotation [2018-11-23 10:49:43,764 WARN L170 areAnnotationChecker]: L595 has no Hoare annotation [2018-11-23 10:49:43,764 WARN L170 areAnnotationChecker]: L996-1 has no Hoare annotation [2018-11-23 10:49:43,764 WARN L170 areAnnotationChecker]: L266 has no Hoare annotation [2018-11-23 10:49:43,764 WARN L170 areAnnotationChecker]: L683-1 has no Hoare annotation [2018-11-23 10:49:43,764 WARN L170 areAnnotationChecker]: L176 has no Hoare annotation [2018-11-23 10:49:43,764 WARN L170 areAnnotationChecker]: L176 has no Hoare annotation [2018-11-23 10:49:43,764 WARN L170 areAnnotationChecker]: L179 has no Hoare annotation [2018-11-23 10:49:43,764 WARN L170 areAnnotationChecker]: L179 has no Hoare annotation [2018-11-23 10:49:43,765 WARN L170 areAnnotationChecker]: L220 has no Hoare annotation [2018-11-23 10:49:43,765 WARN L170 areAnnotationChecker]: L220 has no Hoare annotation [2018-11-23 10:49:43,765 WARN L170 areAnnotationChecker]: L112 has no Hoare annotation [2018-11-23 10:49:43,765 WARN L170 areAnnotationChecker]: L114 has no Hoare annotation [2018-11-23 10:49:43,765 WARN L170 areAnnotationChecker]: L114 has no Hoare annotation [2018-11-23 10:49:43,765 WARN L170 areAnnotationChecker]: mainEXIT has no Hoare annotation [2018-11-23 10:49:43,765 WARN L170 areAnnotationChecker]: L351 has no Hoare annotation [2018-11-23 10:49:43,765 WARN L170 areAnnotationChecker]: L351 has no Hoare annotation [2018-11-23 10:49:43,765 WARN L170 areAnnotationChecker]: L355 has no Hoare annotation [2018-11-23 10:49:43,765 WARN L170 areAnnotationChecker]: L355 has no Hoare annotation [2018-11-23 10:49:43,765 WARN L170 areAnnotationChecker]: L739-1 has no Hoare annotation [2018-11-23 10:49:43,766 WARN L170 areAnnotationChecker]: IofCallDriverEXIT has no Hoare annotation [2018-11-23 10:49:43,766 WARN L170 areAnnotationChecker]: IofCallDriverEXIT has no Hoare annotation [2018-11-23 10:49:43,766 WARN L170 areAnnotationChecker]: IofCallDriverEXIT has no Hoare annotation [2018-11-23 10:49:43,766 WARN L170 areAnnotationChecker]: IofCallDriverEXIT has no Hoare annotation [2018-11-23 10:49:43,766 WARN L170 areAnnotationChecker]: IofCallDriverEXIT has no Hoare annotation [2018-11-23 10:49:43,766 WARN L170 areAnnotationChecker]: PoCallDriverEXIT has no Hoare annotation [2018-11-23 10:49:43,766 WARN L170 areAnnotationChecker]: L603 has no Hoare annotation [2018-11-23 10:49:43,766 WARN L170 areAnnotationChecker]: L605 has no Hoare annotation [2018-11-23 10:49:43,766 WARN L170 areAnnotationChecker]: L191-1 has no Hoare annotation [2018-11-23 10:49:43,766 WARN L170 areAnnotationChecker]: L230-1 has no Hoare annotation [2018-11-23 10:49:43,767 WARN L170 areAnnotationChecker]: L246-1 has no Hoare annotation [2018-11-23 10:49:43,767 WARN L170 areAnnotationChecker]: L261-1 has no Hoare annotation [2018-11-23 10:49:43,767 WARN L170 areAnnotationChecker]: L420 has no Hoare annotation [2018-11-23 10:49:43,767 WARN L170 areAnnotationChecker]: L420 has no Hoare annotation [2018-11-23 10:49:43,767 WARN L170 areAnnotationChecker]: L426 has no Hoare annotation [2018-11-23 10:49:43,767 WARN L170 areAnnotationChecker]: L426 has no Hoare annotation [2018-11-23 10:49:43,767 WARN L170 areAnnotationChecker]: L496 has no Hoare annotation [2018-11-23 10:49:43,767 WARN L170 areAnnotationChecker]: L496 has no Hoare annotation [2018-11-23 10:49:43,767 WARN L170 areAnnotationChecker]: L523 has no Hoare annotation [2018-11-23 10:49:43,767 WARN L170 areAnnotationChecker]: L523 has no Hoare annotation [2018-11-23 10:49:43,768 WARN L170 areAnnotationChecker]: L509 has no Hoare annotation [2018-11-23 10:49:43,768 WARN L170 areAnnotationChecker]: L511 has no Hoare annotation [2018-11-23 10:49:43,768 WARN L170 areAnnotationChecker]: L761 has no Hoare annotation [2018-11-23 10:49:43,768 WARN L170 areAnnotationChecker]: L761 has no Hoare annotation [2018-11-23 10:49:43,768 WARN L170 areAnnotationChecker]: L788 has no Hoare annotation [2018-11-23 10:49:43,768 WARN L170 areAnnotationChecker]: L788 has no Hoare annotation [2018-11-23 10:49:43,768 WARN L170 areAnnotationChecker]: L774 has no Hoare annotation [2018-11-23 10:49:43,768 WARN L170 areAnnotationChecker]: L776 has no Hoare annotation [2018-11-23 10:49:43,768 WARN L170 areAnnotationChecker]: L659-1 has no Hoare annotation [2018-11-23 10:49:43,768 WARN L170 areAnnotationChecker]: L1002-1 has no Hoare annotation [2018-11-23 10:49:43,769 WARN L170 areAnnotationChecker]: L955 has no Hoare annotation [2018-11-23 10:49:43,769 WARN L170 areAnnotationChecker]: L955 has no Hoare annotation [2018-11-23 10:49:43,769 WARN L170 areAnnotationChecker]: L902 has no Hoare annotation [2018-11-23 10:49:43,769 WARN L170 areAnnotationChecker]: L902 has no Hoare annotation [2018-11-23 10:49:43,769 WARN L170 areAnnotationChecker]: KbFilter_InternIoCtlFINAL has no Hoare annotation [2018-11-23 10:49:43,769 WARN L170 areAnnotationChecker]: KbFilter_PnPFINAL has no Hoare annotation [2018-11-23 10:49:43,769 WARN L170 areAnnotationChecker]: KbFilter_DispatchPassThroughFINAL has no Hoare annotation [2018-11-23 10:49:43,769 WARN L170 areAnnotationChecker]: L181 has no Hoare annotation [2018-11-23 10:49:43,769 WARN L170 areAnnotationChecker]: L181 has no Hoare annotation [2018-11-23 10:49:43,769 WARN L170 areAnnotationChecker]: L224 has no Hoare annotation [2018-11-23 10:49:43,770 WARN L170 areAnnotationChecker]: L224 has no Hoare annotation [2018-11-23 10:49:43,770 WARN L170 areAnnotationChecker]: L236 has no Hoare annotation [2018-11-23 10:49:43,770 WARN L170 areAnnotationChecker]: L236 has no Hoare annotation [2018-11-23 10:49:43,770 WARN L170 areAnnotationChecker]: L168 has no Hoare annotation [2018-11-23 10:49:43,770 WARN L170 areAnnotationChecker]: L168 has no Hoare annotation [2018-11-23 10:49:43,770 WARN L170 areAnnotationChecker]: L117 has no Hoare annotation [2018-11-23 10:49:43,770 WARN L170 areAnnotationChecker]: L117 has no Hoare annotation [2018-11-23 10:49:43,770 WARN L170 areAnnotationChecker]: L377 has no Hoare annotation [2018-11-23 10:49:43,770 WARN L170 areAnnotationChecker]: L356 has no Hoare annotation [2018-11-23 10:49:43,770 WARN L170 areAnnotationChecker]: L356 has no Hoare annotation [2018-11-23 10:49:43,770 WARN L170 areAnnotationChecker]: L360 has no Hoare annotation [2018-11-23 10:49:43,771 WARN L170 areAnnotationChecker]: L360 has no Hoare annotation [2018-11-23 10:49:43,771 WARN L170 areAnnotationChecker]: KbFilter_PowerFINAL has no Hoare annotation [2018-11-23 10:49:43,771 WARN L170 areAnnotationChecker]: KeWaitForSingleObjectFINAL has no Hoare annotation [2018-11-23 10:49:43,771 WARN L170 areAnnotationChecker]: L196 has no Hoare annotation [2018-11-23 10:49:43,771 WARN L170 areAnnotationChecker]: L196 has no Hoare annotation [2018-11-23 10:49:43,771 WARN L170 areAnnotationChecker]: L428 has no Hoare annotation [2018-11-23 10:49:43,771 WARN L170 areAnnotationChecker]: L428 has no Hoare annotation [2018-11-23 10:49:43,771 WARN L170 areAnnotationChecker]: L531 has no Hoare annotation [2018-11-23 10:49:43,771 WARN L170 areAnnotationChecker]: L531 has no Hoare annotation [2018-11-23 10:49:43,771 WARN L170 areAnnotationChecker]: L796 has no Hoare annotation [2018-11-23 10:49:43,772 WARN L170 areAnnotationChecker]: L796 has no Hoare annotation [2018-11-23 10:49:43,772 WARN L170 areAnnotationChecker]: KbFilter_CreateCloseFINAL has no Hoare annotation [2018-11-23 10:49:43,772 WARN L170 areAnnotationChecker]: L955-2 has no Hoare annotation [2018-11-23 10:49:43,772 WARN L170 areAnnotationChecker]: L955-2 has no Hoare annotation [2018-11-23 10:49:43,772 WARN L170 areAnnotationChecker]: L909 has no Hoare annotation [2018-11-23 10:49:43,772 WARN L170 areAnnotationChecker]: L909 has no Hoare annotation [2018-11-23 10:49:43,772 WARN L170 areAnnotationChecker]: KbFilter_InternIoCtlEXIT has no Hoare annotation [2018-11-23 10:49:43,772 WARN L170 areAnnotationChecker]: KbFilter_PnPEXIT has no Hoare annotation [2018-11-23 10:49:43,772 WARN L170 areAnnotationChecker]: KbFilter_DispatchPassThroughEXIT has no Hoare annotation [2018-11-23 10:49:43,772 WARN L170 areAnnotationChecker]: KbFilter_DispatchPassThroughEXIT has no Hoare annotation [2018-11-23 10:49:43,772 WARN L170 areAnnotationChecker]: L240 has no Hoare annotation [2018-11-23 10:49:43,773 WARN L170 areAnnotationChecker]: L240 has no Hoare annotation [2018-11-23 10:49:43,774 WARN L170 areAnnotationChecker]: L255 has no Hoare annotation [2018-11-23 10:49:43,774 WARN L170 areAnnotationChecker]: L255 has no Hoare annotation [2018-11-23 10:49:43,774 WARN L170 areAnnotationChecker]: L120 has no Hoare annotation [2018-11-23 10:49:43,774 WARN L170 areAnnotationChecker]: L120 has no Hoare annotation [2018-11-23 10:49:43,774 WARN L170 areAnnotationChecker]: L382 has no Hoare annotation [2018-11-23 10:49:43,774 WARN L170 areAnnotationChecker]: L361 has no Hoare annotation [2018-11-23 10:49:43,774 WARN L170 areAnnotationChecker]: L361 has no Hoare annotation [2018-11-23 10:49:43,775 WARN L170 areAnnotationChecker]: L365 has no Hoare annotation [2018-11-23 10:49:43,775 WARN L170 areAnnotationChecker]: L365 has no Hoare annotation [2018-11-23 10:49:43,775 WARN L170 areAnnotationChecker]: KbFilter_PowerEXIT has no Hoare annotation [2018-11-23 10:49:43,775 WARN L170 areAnnotationChecker]: KeWaitForSingleObjectEXIT has no Hoare annotation [2018-11-23 10:49:43,775 WARN L170 areAnnotationChecker]: L198 has no Hoare annotation [2018-11-23 10:49:43,775 WARN L170 areAnnotationChecker]: L198 has no Hoare annotation [2018-11-23 10:49:43,775 WARN L170 areAnnotationChecker]: L196-2 has no Hoare annotation [2018-11-23 10:49:43,775 WARN L170 areAnnotationChecker]: L196-2 has no Hoare annotation [2018-11-23 10:49:43,775 WARN L170 areAnnotationChecker]: L429 has no Hoare annotation [2018-11-23 10:49:43,775 WARN L170 areAnnotationChecker]: L429 has no Hoare annotation [2018-11-23 10:49:43,776 WARN L170 areAnnotationChecker]: L532 has no Hoare annotation [2018-11-23 10:49:43,776 WARN L170 areAnnotationChecker]: L532 has no Hoare annotation [2018-11-23 10:49:43,776 WARN L170 areAnnotationChecker]: L540 has no Hoare annotation [2018-11-23 10:49:43,776 WARN L170 areAnnotationChecker]: L540 has no Hoare annotation [2018-11-23 10:49:43,776 WARN L170 areAnnotationChecker]: L799 has no Hoare annotation [2018-11-23 10:49:43,776 WARN L170 areAnnotationChecker]: L799 has no Hoare annotation [2018-11-23 10:49:43,776 WARN L170 areAnnotationChecker]: L808 has no Hoare annotation [2018-11-23 10:49:43,776 WARN L170 areAnnotationChecker]: L808 has no Hoare annotation [2018-11-23 10:49:43,776 WARN L170 areAnnotationChecker]: KbFilter_CreateCloseEXIT has no Hoare annotation [2018-11-23 10:49:43,776 WARN L170 areAnnotationChecker]: KbFilter_CreateCloseEXIT has no Hoare annotation [2018-11-23 10:49:43,777 WARN L170 areAnnotationChecker]: L958-1 has no Hoare annotation [2018-11-23 10:49:43,777 WARN L170 areAnnotationChecker]: L916 has no Hoare annotation [2018-11-23 10:49:43,777 WARN L170 areAnnotationChecker]: L916 has no Hoare annotation [2018-11-23 10:49:43,777 WARN L170 areAnnotationChecker]: L397 has no Hoare annotation [2018-11-23 10:49:43,777 WARN L170 areAnnotationChecker]: L387 has no Hoare annotation [2018-11-23 10:49:43,777 WARN L170 areAnnotationChecker]: L123 has no Hoare annotation [2018-11-23 10:49:43,777 WARN L170 areAnnotationChecker]: L123 has no Hoare annotation [2018-11-23 10:49:43,777 WARN L170 areAnnotationChecker]: L366 has no Hoare annotation [2018-11-23 10:49:43,777 WARN L170 areAnnotationChecker]: L366 has no Hoare annotation [2018-11-23 10:49:43,777 WARN L170 areAnnotationChecker]: L370 has no Hoare annotation [2018-11-23 10:49:43,777 WARN L170 areAnnotationChecker]: L370 has no Hoare annotation [2018-11-23 10:49:43,778 WARN L170 areAnnotationChecker]: L392 has no Hoare annotation [2018-11-23 10:49:43,778 WARN L170 areAnnotationChecker]: L198-1 has no Hoare annotation [2018-11-23 10:49:43,778 WARN L170 areAnnotationChecker]: L205 has no Hoare annotation [2018-11-23 10:49:43,778 WARN L170 areAnnotationChecker]: L205 has no Hoare annotation [2018-11-23 10:49:43,778 WARN L170 areAnnotationChecker]: L204 has no Hoare annotation [2018-11-23 10:49:43,778 WARN L170 areAnnotationChecker]: L430 has no Hoare annotation [2018-11-23 10:49:43,778 WARN L170 areAnnotationChecker]: L430 has no Hoare annotation [2018-11-23 10:49:43,778 WARN L170 areAnnotationChecker]: L438 has no Hoare annotation [2018-11-23 10:49:43,778 WARN L170 areAnnotationChecker]: L438 has no Hoare annotation [2018-11-23 10:49:43,778 WARN L170 areAnnotationChecker]: L545 has no Hoare annotation [2018-11-23 10:49:43,778 WARN L170 areAnnotationChecker]: L545 has no Hoare annotation [2018-11-23 10:49:43,779 WARN L170 areAnnotationChecker]: L813 has no Hoare annotation [2018-11-23 10:49:43,779 WARN L170 areAnnotationChecker]: L813 has no Hoare annotation [2018-11-23 10:49:43,779 WARN L170 areAnnotationChecker]: L923 has no Hoare annotation [2018-11-23 10:49:43,779 WARN L170 areAnnotationChecker]: L923 has no Hoare annotation [2018-11-23 10:49:43,779 WARN L170 areAnnotationChecker]: L126 has no Hoare annotation [2018-11-23 10:49:43,779 WARN L170 areAnnotationChecker]: L126 has no Hoare annotation [2018-11-23 10:49:43,779 WARN L170 areAnnotationChecker]: L371 has no Hoare annotation [2018-11-23 10:49:43,779 WARN L170 areAnnotationChecker]: L371 has no Hoare annotation [2018-11-23 10:49:43,779 WARN L170 areAnnotationChecker]: L373 has no Hoare annotation [2018-11-23 10:49:43,779 WARN L170 areAnnotationChecker]: L215 has no Hoare annotation [2018-11-23 10:49:43,780 WARN L170 areAnnotationChecker]: L215 has no Hoare annotation [2018-11-23 10:49:43,780 WARN L170 areAnnotationChecker]: L431 has no Hoare annotation [2018-11-23 10:49:43,780 WARN L170 areAnnotationChecker]: L431 has no Hoare annotation [2018-11-23 10:49:43,780 WARN L170 areAnnotationChecker]: L440 has no Hoare annotation [2018-11-23 10:49:43,780 WARN L170 areAnnotationChecker]: L440 has no Hoare annotation [2018-11-23 10:49:43,780 WARN L170 areAnnotationChecker]: L446 has no Hoare annotation [2018-11-23 10:49:43,780 WARN L170 areAnnotationChecker]: L446 has no Hoare annotation [2018-11-23 10:49:43,780 WARN L170 areAnnotationChecker]: L930 has no Hoare annotation [2018-11-23 10:49:43,780 WARN L170 areAnnotationChecker]: L930 has no Hoare annotation [2018-11-23 10:49:43,780 WARN L170 areAnnotationChecker]: L129 has no Hoare annotation [2018-11-23 10:49:43,780 WARN L170 areAnnotationChecker]: L129 has no Hoare annotation [2018-11-23 10:49:43,781 WARN L170 areAnnotationChecker]: L442 has no Hoare annotation [2018-11-23 10:49:43,781 WARN L170 areAnnotationChecker]: L442 has no Hoare annotation [2018-11-23 10:49:43,781 WARN L170 areAnnotationChecker]: L447 has no Hoare annotation [2018-11-23 10:49:43,781 WARN L170 areAnnotationChecker]: L447 has no Hoare annotation [2018-11-23 10:49:43,781 WARN L170 areAnnotationChecker]: L451 has no Hoare annotation [2018-11-23 10:49:43,781 WARN L170 areAnnotationChecker]: L451 has no Hoare annotation [2018-11-23 10:49:43,781 WARN L170 areAnnotationChecker]: L933 has no Hoare annotation [2018-11-23 10:49:43,781 WARN L170 areAnnotationChecker]: L933 has no Hoare annotation [2018-11-23 10:49:43,781 WARN L170 areAnnotationChecker]: L132 has no Hoare annotation [2018-11-23 10:49:43,781 WARN L170 areAnnotationChecker]: L132 has no Hoare annotation [2018-11-23 10:49:43,781 WARN L170 areAnnotationChecker]: L452 has no Hoare annotation [2018-11-23 10:49:43,782 WARN L170 areAnnotationChecker]: L452 has no Hoare annotation [2018-11-23 10:49:43,782 WARN L170 areAnnotationChecker]: L135 has no Hoare annotation [2018-11-23 10:49:43,782 WARN L170 areAnnotationChecker]: L135 has no Hoare annotation [2018-11-23 10:49:43,782 WARN L170 areAnnotationChecker]: L138 has no Hoare annotation [2018-11-23 10:49:43,782 WARN L170 areAnnotationChecker]: L138 has no Hoare annotation [2018-11-23 10:49:43,782 WARN L170 areAnnotationChecker]: L141 has no Hoare annotation [2018-11-23 10:49:43,782 WARN L170 areAnnotationChecker]: L141 has no Hoare annotation [2018-11-23 10:49:43,782 WARN L170 areAnnotationChecker]: L144 has no Hoare annotation [2018-11-23 10:49:43,782 WARN L170 areAnnotationChecker]: L144 has no Hoare annotation [2018-11-23 10:49:43,782 WARN L170 areAnnotationChecker]: L147 has no Hoare annotation [2018-11-23 10:49:43,782 WARN L170 areAnnotationChecker]: L147 has no Hoare annotation [2018-11-23 10:49:43,783 WARN L170 areAnnotationChecker]: L150 has no Hoare annotation [2018-11-23 10:49:43,783 WARN L170 areAnnotationChecker]: L150 has no Hoare annotation [2018-11-23 10:49:43,783 WARN L170 areAnnotationChecker]: L153 has no Hoare annotation [2018-11-23 10:49:43,783 WARN L170 areAnnotationChecker]: L153 has no Hoare annotation [2018-11-23 10:49:43,783 WARN L170 areAnnotationChecker]: L156 has no Hoare annotation [2018-11-23 10:49:43,784 WARN L170 areAnnotationChecker]: L156 has no Hoare annotation [2018-11-23 10:49:43,784 WARN L170 areAnnotationChecker]: L159 has no Hoare annotation [2018-11-23 10:49:43,784 WARN L170 areAnnotationChecker]: L159 has no Hoare annotation [2018-11-23 10:49:43,784 WARN L170 areAnnotationChecker]: L162 has no Hoare annotation [2018-11-23 10:49:43,784 WARN L170 areAnnotationChecker]: L162 has no Hoare annotation [2018-11-23 10:49:43,784 WARN L170 areAnnotationChecker]: L165 has no Hoare annotation [2018-11-23 10:49:43,784 WARN L170 areAnnotationChecker]: L165 has no Hoare annotation [2018-11-23 10:49:43,784 INFO L163 areAnnotationChecker]: CFG has 0 edges. 0 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. 0 times interpolants missing. [2018-11-23 10:49:43,789 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction CFG 23.11 10:49:43 BoogieIcfgContainer [2018-11-23 10:49:43,790 INFO L132 PluginConnector]: ------------------------ END TraceAbstraction---------------------------- [2018-11-23 10:49:43,790 INFO L113 PluginConnector]: ------------------------Witness Printer---------------------------- [2018-11-23 10:49:43,790 INFO L271 PluginConnector]: Initializing Witness Printer... [2018-11-23 10:49:43,790 INFO L276 PluginConnector]: Witness Printer initialized [2018-11-23 10:49:43,791 INFO L185 PluginConnector]: Executing the observer RCFGCatcher from plugin Witness Printer for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 23.11 10:48:35" (3/4) ... [2018-11-23 10:49:43,794 INFO L138 WitnessPrinter]: Generating witness for reachability counterexample ----- class de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder.RCFGBacktranslator [?] CALL call ULTIMATE.init(); VAL [|old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv0 32), ~DevicePowerState~0=(_ bv0 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv0 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv0 32), ~MPR3~0=(_ bv0 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv0 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv0 32), ~SKIP2~0=(_ bv0 32), ~s~0=(_ bv0 32), ~UNLOADED~0=(_ bv0 32)] [?] ~KernelMode~0 := 0bv32;~Executive~0 := 0bv32;~DevicePowerState~0 := 0bv32;~s~0 := 0bv32;~UNLOADED~0 := 0bv32;~NP~0 := 0bv32;~DC~0 := 0bv32;~SKIP1~0 := 0bv32;~SKIP2~0 := 0bv32;~MPR1~0 := 0bv32;~MPR3~0 := 0bv32;~IPC~0 := 0bv32;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32;~myStatus~0 := 0bv32; VAL [|old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv0 32), ~DevicePowerState~0=(_ bv0 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv0 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv0 32), ~MPR3~0=(_ bv0 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv0 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv0 32), ~SKIP2~0=(_ bv0 32), ~s~0=(_ bv0 32), ~UNLOADED~0=(_ bv0 32)] [?] assume true; VAL [|old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv0 32), ~DevicePowerState~0=(_ bv0 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv0 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv0 32), ~MPR3~0=(_ bv0 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv0 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv0 32), ~SKIP2~0=(_ bv0 32), ~s~0=(_ bv0 32), ~UNLOADED~0=(_ bv0 32)] [?] RET #759#return; VAL [~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv0 32), ~DevicePowerState~0=(_ bv0 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv0 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv0 32), ~MPR3~0=(_ bv0 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv0 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv0 32), ~SKIP2~0=(_ bv0 32), ~s~0=(_ bv0 32), ~UNLOADED~0=(_ bv0 32)] [?] CALL call #t~ret77 := main(); VAL [|old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv0 32), ~DevicePowerState~0=(_ bv0 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv0 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv0 32), ~MPR3~0=(_ bv0 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv0 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv0 32), ~SKIP2~0=(_ bv0 32), ~s~0=(_ bv0 32), ~UNLOADED~0=(_ bv0 32)] [?] havoc ~status~1;~irp~0 := #t~nondet17;havoc #t~nondet17;havoc ~pirp~0;havoc ~pirp__IoStatus__Status~0;~irp_choice~0 := #t~nondet18;havoc #t~nondet18;~devobj~0 := #t~nondet19;havoc #t~nondet19;havoc ~__cil_tmp8~0;~KernelMode~0 := 0bv32;~Executive~0 := 0bv32;~DevicePowerState~0 := 1bv32;~s~0 := 0bv32;~UNLOADED~0 := 0bv32;~NP~0 := 0bv32;~DC~0 := 0bv32;~SKIP1~0 := 0bv32;~SKIP2~0 := 0bv32;~MPR1~0 := 0bv32;~MPR3~0 := 0bv32;~IPC~0 := 0bv32;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32;~myStatus~0 := 0bv32;~status~1 := 0bv32;~pirp~0 := ~irp~0; VAL [main_~devobj~0=(_ bv0 32), main_~irp_choice~0=(_ bv1 32), main_~irp~0=(_ bv0 32), main_~pirp~0=(_ bv0 32), main_~status~1=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv0 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv0 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv0 32), ~MPR3~0=(_ bv0 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv0 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv0 32), ~SKIP2~0=(_ bv0 32), ~s~0=(_ bv0 32), ~UNLOADED~0=(_ bv0 32)] [?] CALL call _BLAST_init(); VAL [|old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv0 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv0 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv0 32), ~MPR3~0=(_ bv0 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv0 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv0 32), ~SKIP2~0=(_ bv0 32), ~s~0=(_ bv0 32), ~UNLOADED~0=(_ bv0 32)] [?] ~UNLOADED~0 := 0bv32;~NP~0 := 1bv32;~DC~0 := 2bv32;~SKIP1~0 := 3bv32;~SKIP2~0 := 4bv32;~MPR1~0 := 5bv32;~MPR3~0 := 6bv32;~IPC~0 := 7bv32;~s~0 := ~UNLOADED~0;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32; VAL [|old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv0 32), ~UNLOADED~0=(_ bv0 32)] [?] assume true; VAL [|old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv0 32), ~UNLOADED~0=(_ bv0 32)] [?] RET #717#return; VAL [main_~devobj~0=(_ bv0 32), main_~irp_choice~0=(_ bv1 32), main_~irp~0=(_ bv0 32), main_~pirp~0=(_ bv0 32), main_~status~1=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv0 32), ~UNLOADED~0=(_ bv0 32)] [?] assume ~bvsge32(~status~1, 0bv32);~s~0 := ~NP~0;~customIrp~0 := 0bv32;~setEventCalled~0 := ~customIrp~0;~lowerDriverReturn~0 := ~setEventCalled~0;~compRegistered~0 := ~lowerDriverReturn~0;~pended~0 := ~compRegistered~0;~pirp__IoStatus__Status~0 := 0bv32;~myStatus~0 := 0bv32; VAL [main_~devobj~0=(_ bv0 32), main_~irp_choice~0=(_ bv1 32), main_~irp~0=(_ bv0 32), main_~pirp__IoStatus__Status~0=(_ bv0 32), main_~pirp~0=(_ bv0 32), main_~status~1=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv1 32), ~UNLOADED~0=(_ bv0 32)] [?] assume !(0bv32 == ~irp_choice~0); VAL [main_~devobj~0=(_ bv0 32), main_~irp_choice~0=(_ bv1 32), main_~irp~0=(_ bv0 32), main_~pirp__IoStatus__Status~0=(_ bv0 32), main_~pirp~0=(_ bv0 32), main_~status~1=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv1 32), ~UNLOADED~0=(_ bv0 32)] [?] CALL call stub_driver_init(); VAL [|old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv1 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv1 32), ~UNLOADED~0=(_ bv0 32)] [?] ~s~0 := ~NP~0;~pended~0 := 0bv32;~compFptr~0 := 0bv32;~compRegistered~0 := 0bv32;~lowerDriverReturn~0 := 0bv32;~setEventCalled~0 := 0bv32;~customIrp~0 := 0bv32; VAL [|old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv1 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv1 32), ~UNLOADED~0=(_ bv0 32)] [?] assume true; VAL [|old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv1 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv1 32), ~UNLOADED~0=(_ bv0 32)] [?] RET #719#return; VAL [main_~devobj~0=(_ bv0 32), main_~irp_choice~0=(_ bv1 32), main_~irp~0=(_ bv0 32), main_~pirp__IoStatus__Status~0=(_ bv0 32), main_~pirp~0=(_ bv0 32), main_~status~1=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv1 32), ~UNLOADED~0=(_ bv0 32)] [?] assume !~bvslt32(~status~1, 0bv32);havoc ~tmp_ndt_1~0;~tmp_ndt_1~0 := #t~nondet20;havoc #t~nondet20; VAL [main_~devobj~0=(_ bv0 32), main_~irp_choice~0=(_ bv1 32), main_~irp~0=(_ bv0 32), main_~pirp__IoStatus__Status~0=(_ bv0 32), main_~pirp~0=(_ bv0 32), main_~status~1=(_ bv0 32), main_~tmp_ndt_1~0=(_ bv1 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv1 32), ~UNLOADED~0=(_ bv0 32)] [?] assume !(0bv32 == ~tmp_ndt_1~0);havoc ~tmp_ndt_2~0;~tmp_ndt_2~0 := #t~nondet21;havoc #t~nondet21; VAL [main_~devobj~0=(_ bv0 32), main_~irp_choice~0=(_ bv1 32), main_~irp~0=(_ bv0 32), main_~pirp__IoStatus__Status~0=(_ bv0 32), main_~pirp~0=(_ bv0 32), main_~status~1=(_ bv0 32), main_~tmp_ndt_1~0=(_ bv1 32), main_~tmp_ndt_2~0=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv1 32), ~UNLOADED~0=(_ bv0 32)] [?] assume !(1bv32 == ~tmp_ndt_2~0);havoc ~tmp_ndt_3~0;~tmp_ndt_3~0 := #t~nondet22;havoc #t~nondet22; VAL [main_~devobj~0=(_ bv0 32), main_~irp_choice~0=(_ bv1 32), main_~irp~0=(_ bv0 32), main_~pirp__IoStatus__Status~0=(_ bv0 32), main_~pirp~0=(_ bv0 32), main_~status~1=(_ bv0 32), main_~tmp_ndt_1~0=(_ bv1 32), main_~tmp_ndt_2~0=(_ bv0 32), main_~tmp_ndt_3~0=(_ bv3 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv1 32), ~UNLOADED~0=(_ bv0 32)] [?] assume 3bv32 == ~tmp_ndt_3~0; VAL [main_~devobj~0=(_ bv0 32), main_~irp_choice~0=(_ bv1 32), main_~irp~0=(_ bv0 32), main_~pirp__IoStatus__Status~0=(_ bv0 32), main_~pirp~0=(_ bv0 32), main_~status~1=(_ bv0 32), main_~tmp_ndt_1~0=(_ bv1 32), main_~tmp_ndt_2~0=(_ bv0 32), main_~tmp_ndt_3~0=(_ bv3 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv1 32), ~UNLOADED~0=(_ bv0 32)] [?] CALL call #t~ret27 := KbFilter_PnP(~devobj~0, ~pirp~0); VAL [|KbFilter_PnP_#in~DeviceObject|=(_ bv0 32), |KbFilter_PnP_#in~Irp|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv1 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv1 32), ~UNLOADED~0=(_ bv0 32)] [?] ~DeviceObject := #in~DeviceObject;~Irp := #in~Irp;havoc ~devExt~0;havoc ~irpStack~0;havoc ~status~0;~event~0 := #t~nondet0;havoc #t~nondet0;~DeviceObject__DeviceExtension~0 := #t~nondet1;havoc #t~nondet1;~Irp__Tail__Overlay__CurrentStackLocation~0 := #t~nondet2;havoc #t~nondet2;~irpStack__MinorFunction~0 := #t~nondet3;havoc #t~nondet3;~devExt__TopOfStack~0 := #t~nondet4;havoc #t~nondet4;havoc ~devExt__Started~0;havoc ~devExt__Removed~0;havoc ~devExt__SurpriseRemoved~0;havoc ~Irp__IoStatus__Status~0;havoc ~Irp__IoStatus__Information~0;~Irp__CurrentLocation~0 := #t~nondet5;havoc #t~nondet5;havoc ~irpSp~0;havoc ~nextIrpSp~0;havoc ~nextIrpSp__Control~0;havoc ~irpSp___0~0;havoc ~irpSp__Context~0;havoc ~irpSp__Control~0;havoc ~__cil_tmp23~0;~status~0 := 0bv32;~devExt~0 := ~DeviceObject__DeviceExtension~0;~irpStack~0 := ~Irp__Tail__Overlay__CurrentStackLocation~0; VAL [KbFilter_PnP_~devExt__TopOfStack~0=(_ bv0 32), KbFilter_PnP_~devExt~0=(_ bv0 32), KbFilter_PnP_~DeviceObject=(_ bv0 32), KbFilter_PnP_~DeviceObject__DeviceExtension~0=(_ bv0 32), KbFilter_PnP_~event~0=(_ bv0 32), KbFilter_PnP_~Irp=(_ bv0 32), KbFilter_PnP_~Irp__CurrentLocation~0=(_ bv2147483647 32), KbFilter_PnP_~Irp__Tail__Overlay__CurrentStackLocation~0=(_ bv2147483647 32), KbFilter_PnP_~irpStack__MinorFunction~0=(_ bv2 32), KbFilter_PnP_~irpStack~0=(_ bv2147483647 32), KbFilter_PnP_~status~0=(_ bv0 32), |KbFilter_PnP_#in~DeviceObject|=(_ bv0 32), |KbFilter_PnP_#in~Irp|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv1 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv1 32), ~UNLOADED~0=(_ bv0 32)] [?] assume !(0bv32 == ~irpStack__MinorFunction~0); VAL [KbFilter_PnP_~devExt__TopOfStack~0=(_ bv0 32), KbFilter_PnP_~devExt~0=(_ bv0 32), KbFilter_PnP_~DeviceObject=(_ bv0 32), KbFilter_PnP_~DeviceObject__DeviceExtension~0=(_ bv0 32), KbFilter_PnP_~event~0=(_ bv0 32), KbFilter_PnP_~Irp=(_ bv0 32), KbFilter_PnP_~Irp__CurrentLocation~0=(_ bv2147483647 32), KbFilter_PnP_~Irp__Tail__Overlay__CurrentStackLocation~0=(_ bv2147483647 32), KbFilter_PnP_~irpStack__MinorFunction~0=(_ bv2 32), KbFilter_PnP_~irpStack~0=(_ bv2147483647 32), KbFilter_PnP_~status~0=(_ bv0 32), |KbFilter_PnP_#in~DeviceObject|=(_ bv0 32), |KbFilter_PnP_#in~Irp|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv1 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv1 32), ~UNLOADED~0=(_ bv0 32)] [?] assume !(23bv32 == ~irpStack__MinorFunction~0); VAL [KbFilter_PnP_~devExt__TopOfStack~0=(_ bv0 32), KbFilter_PnP_~devExt~0=(_ bv0 32), KbFilter_PnP_~DeviceObject=(_ bv0 32), KbFilter_PnP_~DeviceObject__DeviceExtension~0=(_ bv0 32), KbFilter_PnP_~event~0=(_ bv0 32), KbFilter_PnP_~Irp=(_ bv0 32), KbFilter_PnP_~Irp__CurrentLocation~0=(_ bv2147483647 32), KbFilter_PnP_~Irp__Tail__Overlay__CurrentStackLocation~0=(_ bv2147483647 32), KbFilter_PnP_~irpStack__MinorFunction~0=(_ bv2 32), KbFilter_PnP_~irpStack~0=(_ bv2147483647 32), KbFilter_PnP_~status~0=(_ bv0 32), |KbFilter_PnP_#in~DeviceObject|=(_ bv0 32), |KbFilter_PnP_#in~Irp|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv1 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv1 32), ~UNLOADED~0=(_ bv0 32)] [?] assume 2bv32 == ~irpStack__MinorFunction~0; VAL [KbFilter_PnP_~devExt__TopOfStack~0=(_ bv0 32), KbFilter_PnP_~devExt~0=(_ bv0 32), KbFilter_PnP_~DeviceObject=(_ bv0 32), KbFilter_PnP_~DeviceObject__DeviceExtension~0=(_ bv0 32), KbFilter_PnP_~event~0=(_ bv0 32), KbFilter_PnP_~Irp=(_ bv0 32), KbFilter_PnP_~Irp__CurrentLocation~0=(_ bv2147483647 32), KbFilter_PnP_~Irp__Tail__Overlay__CurrentStackLocation~0=(_ bv2147483647 32), KbFilter_PnP_~irpStack__MinorFunction~0=(_ bv2 32), KbFilter_PnP_~irpStack~0=(_ bv2147483647 32), KbFilter_PnP_~status~0=(_ bv0 32), |KbFilter_PnP_#in~DeviceObject|=(_ bv0 32), |KbFilter_PnP_#in~Irp|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv1 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv1 32), ~UNLOADED~0=(_ bv0 32)] [?] ~devExt__Removed~0 := 1bv32; VAL [KbFilter_PnP_~devExt__Removed~0=(_ bv1 32), KbFilter_PnP_~devExt__TopOfStack~0=(_ bv0 32), KbFilter_PnP_~devExt~0=(_ bv0 32), KbFilter_PnP_~DeviceObject=(_ bv0 32), KbFilter_PnP_~DeviceObject__DeviceExtension~0=(_ bv0 32), KbFilter_PnP_~event~0=(_ bv0 32), KbFilter_PnP_~Irp=(_ bv0 32), KbFilter_PnP_~Irp__CurrentLocation~0=(_ bv2147483647 32), KbFilter_PnP_~Irp__Tail__Overlay__CurrentStackLocation~0=(_ bv2147483647 32), KbFilter_PnP_~irpStack__MinorFunction~0=(_ bv2 32), KbFilter_PnP_~irpStack~0=(_ bv2147483647 32), KbFilter_PnP_~status~0=(_ bv0 32), |KbFilter_PnP_#in~DeviceObject|=(_ bv0 32), |KbFilter_PnP_#in~Irp|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv1 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv1 32), ~UNLOADED~0=(_ bv0 32)] [?] assume ~s~0 == ~NP~0;~s~0 := ~SKIP1~0; VAL [KbFilter_PnP_~devExt__Removed~0=(_ bv1 32), KbFilter_PnP_~devExt__TopOfStack~0=(_ bv0 32), KbFilter_PnP_~devExt~0=(_ bv0 32), KbFilter_PnP_~DeviceObject=(_ bv0 32), KbFilter_PnP_~DeviceObject__DeviceExtension~0=(_ bv0 32), KbFilter_PnP_~event~0=(_ bv0 32), KbFilter_PnP_~Irp=(_ bv0 32), KbFilter_PnP_~Irp__CurrentLocation~0=(_ bv2147483647 32), KbFilter_PnP_~Irp__Tail__Overlay__CurrentStackLocation~0=(_ bv2147483647 32), KbFilter_PnP_~irpStack__MinorFunction~0=(_ bv2 32), KbFilter_PnP_~irpStack~0=(_ bv2147483647 32), KbFilter_PnP_~status~0=(_ bv0 32), |KbFilter_PnP_#in~DeviceObject|=(_ bv0 32), |KbFilter_PnP_#in~Irp|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv1 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv3 32), ~UNLOADED~0=(_ bv0 32)] [?] #t~post11 := ~Irp__CurrentLocation~0;~Irp__CurrentLocation~0 := ~bvadd32(1bv32, #t~post11);havoc #t~post11;#t~post12 := ~Irp__Tail__Overlay__CurrentStackLocation~0;~Irp__Tail__Overlay__CurrentStackLocation~0 := ~bvadd32(1bv32, #t~post12);havoc #t~post12; VAL [KbFilter_PnP_~devExt__Removed~0=(_ bv1 32), KbFilter_PnP_~devExt__TopOfStack~0=(_ bv0 32), KbFilter_PnP_~devExt~0=(_ bv0 32), KbFilter_PnP_~DeviceObject=(_ bv0 32), KbFilter_PnP_~DeviceObject__DeviceExtension~0=(_ bv0 32), KbFilter_PnP_~event~0=(_ bv0 32), KbFilter_PnP_~Irp=(_ bv0 32), KbFilter_PnP_~Irp__CurrentLocation~0=(_ bv2147483648 32), KbFilter_PnP_~Irp__Tail__Overlay__CurrentStackLocation~0=(_ bv2147483648 32), KbFilter_PnP_~irpStack__MinorFunction~0=(_ bv2 32), KbFilter_PnP_~irpStack~0=(_ bv2147483647 32), KbFilter_PnP_~status~0=(_ bv0 32), |KbFilter_PnP_#in~DeviceObject|=(_ bv0 32), |KbFilter_PnP_#in~Irp|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv1 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv3 32), ~UNLOADED~0=(_ bv0 32)] [?] CALL call #t~ret13 := IofCallDriver(~devExt__TopOfStack~0, ~Irp); VAL [|IofCallDriver_#in~DeviceObject|=(_ bv0 32), |IofCallDriver_#in~Irp|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv3 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv3 32), ~UNLOADED~0=(_ bv0 32)] [?] ~DeviceObject := #in~DeviceObject;~Irp := #in~Irp;havoc ~returnVal2~0;havoc ~compRetStatus~0;~lcontext~0 := #t~nondet30;havoc #t~nondet30;havoc ~__cil_tmp7~0; VAL [IofCallDriver_~DeviceObject=(_ bv0 32), IofCallDriver_~Irp=(_ bv0 32), IofCallDriver_~lcontext~0=(_ bv0 32), |IofCallDriver_#in~DeviceObject|=(_ bv0 32), |IofCallDriver_#in~Irp|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv3 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv3 32), ~UNLOADED~0=(_ bv0 32)] [?] assume !(0bv32 != ~compRegistered~0); VAL [IofCallDriver_~DeviceObject=(_ bv0 32), IofCallDriver_~Irp=(_ bv0 32), IofCallDriver_~lcontext~0=(_ bv0 32), |IofCallDriver_#in~DeviceObject|=(_ bv0 32), |IofCallDriver_#in~Irp|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv3 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv3 32), ~UNLOADED~0=(_ bv0 32)] [?] havoc ~tmp_ndt_6~0;~tmp_ndt_6~0 := #t~nondet32;havoc #t~nondet32; VAL [IofCallDriver_~DeviceObject=(_ bv0 32), IofCallDriver_~Irp=(_ bv0 32), IofCallDriver_~lcontext~0=(_ bv0 32), IofCallDriver_~tmp_ndt_6~0=(_ bv1 32), |IofCallDriver_#in~DeviceObject|=(_ bv0 32), |IofCallDriver_#in~Irp|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv3 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv3 32), ~UNLOADED~0=(_ bv0 32)] [?] assume !(0bv32 == ~tmp_ndt_6~0);havoc ~tmp_ndt_7~0;~tmp_ndt_7~0 := #t~nondet33;havoc #t~nondet33; VAL [IofCallDriver_~DeviceObject=(_ bv0 32), IofCallDriver_~Irp=(_ bv0 32), IofCallDriver_~lcontext~0=(_ bv0 32), IofCallDriver_~tmp_ndt_6~0=(_ bv1 32), IofCallDriver_~tmp_ndt_7~0=(_ bv1 32), |IofCallDriver_#in~DeviceObject|=(_ bv0 32), |IofCallDriver_#in~Irp|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv3 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv3 32), ~UNLOADED~0=(_ bv0 32)] [?] assume 1bv32 == ~tmp_ndt_7~0; VAL [IofCallDriver_~DeviceObject=(_ bv0 32), IofCallDriver_~Irp=(_ bv0 32), IofCallDriver_~lcontext~0=(_ bv0 32), IofCallDriver_~tmp_ndt_6~0=(_ bv1 32), IofCallDriver_~tmp_ndt_7~0=(_ bv1 32), |IofCallDriver_#in~DeviceObject|=(_ bv0 32), |IofCallDriver_#in~Irp|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv3 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv3 32), ~UNLOADED~0=(_ bv0 32)] [?] ~returnVal2~0 := 3221225473bv32; VAL [IofCallDriver_~DeviceObject=(_ bv0 32), IofCallDriver_~Irp=(_ bv0 32), IofCallDriver_~lcontext~0=(_ bv0 32), IofCallDriver_~returnVal2~0=(_ bv3221225473 32), IofCallDriver_~tmp_ndt_6~0=(_ bv1 32), IofCallDriver_~tmp_ndt_7~0=(_ bv1 32), |IofCallDriver_#in~DeviceObject|=(_ bv0 32), |IofCallDriver_#in~Irp|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv3 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv3 32), ~UNLOADED~0=(_ bv0 32)] [?] assume !(~s~0 == ~NP~0); VAL [IofCallDriver_~DeviceObject=(_ bv0 32), IofCallDriver_~Irp=(_ bv0 32), IofCallDriver_~lcontext~0=(_ bv0 32), IofCallDriver_~returnVal2~0=(_ bv3221225473 32), IofCallDriver_~tmp_ndt_6~0=(_ bv1 32), IofCallDriver_~tmp_ndt_7~0=(_ bv1 32), |IofCallDriver_#in~DeviceObject|=(_ bv0 32), |IofCallDriver_#in~Irp|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv3 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv3 32), ~UNLOADED~0=(_ bv0 32)] [?] assume !(~s~0 == ~MPR1~0); VAL [IofCallDriver_~DeviceObject=(_ bv0 32), IofCallDriver_~Irp=(_ bv0 32), IofCallDriver_~lcontext~0=(_ bv0 32), IofCallDriver_~returnVal2~0=(_ bv3221225473 32), IofCallDriver_~tmp_ndt_6~0=(_ bv1 32), IofCallDriver_~tmp_ndt_7~0=(_ bv1 32), |IofCallDriver_#in~DeviceObject|=(_ bv0 32), |IofCallDriver_#in~Irp|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv3 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv0 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv3 32), ~UNLOADED~0=(_ bv0 32)] [?] assume ~s~0 == ~SKIP1~0;~s~0 := ~SKIP2~0;~lowerDriverReturn~0 := ~returnVal2~0; VAL [IofCallDriver_~DeviceObject=(_ bv0 32), IofCallDriver_~Irp=(_ bv0 32), IofCallDriver_~lcontext~0=(_ bv0 32), IofCallDriver_~returnVal2~0=(_ bv3221225473 32), IofCallDriver_~tmp_ndt_6~0=(_ bv1 32), IofCallDriver_~tmp_ndt_7~0=(_ bv1 32), |IofCallDriver_#in~DeviceObject|=(_ bv0 32), |IofCallDriver_#in~Irp|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv3 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv3221225473 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv4 32), ~UNLOADED~0=(_ bv0 32)] [?] #res := ~returnVal2~0; VAL [IofCallDriver_~DeviceObject=(_ bv0 32), IofCallDriver_~Irp=(_ bv0 32), IofCallDriver_~lcontext~0=(_ bv0 32), IofCallDriver_~returnVal2~0=(_ bv3221225473 32), IofCallDriver_~tmp_ndt_6~0=(_ bv1 32), IofCallDriver_~tmp_ndt_7~0=(_ bv1 32), |IofCallDriver_#in~DeviceObject|=(_ bv0 32), |IofCallDriver_#in~Irp|=(_ bv0 32), |IofCallDriver_#res|=(_ bv3221225473 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv3 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv3221225473 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv4 32), ~UNLOADED~0=(_ bv0 32)] [?] assume true; VAL [IofCallDriver_~DeviceObject=(_ bv0 32), IofCallDriver_~Irp=(_ bv0 32), IofCallDriver_~lcontext~0=(_ bv0 32), IofCallDriver_~returnVal2~0=(_ bv3221225473 32), IofCallDriver_~tmp_ndt_6~0=(_ bv1 32), IofCallDriver_~tmp_ndt_7~0=(_ bv1 32), |IofCallDriver_#in~DeviceObject|=(_ bv0 32), |IofCallDriver_#in~Irp|=(_ bv0 32), |IofCallDriver_#res|=(_ bv3221225473 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv3 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv3221225473 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv4 32), ~UNLOADED~0=(_ bv0 32)] [?] RET #783#return; VAL [KbFilter_PnP_~devExt__Removed~0=(_ bv1 32), KbFilter_PnP_~devExt__TopOfStack~0=(_ bv0 32), KbFilter_PnP_~devExt~0=(_ bv0 32), KbFilter_PnP_~DeviceObject=(_ bv0 32), KbFilter_PnP_~DeviceObject__DeviceExtension~0=(_ bv0 32), KbFilter_PnP_~event~0=(_ bv0 32), KbFilter_PnP_~Irp=(_ bv0 32), KbFilter_PnP_~Irp__CurrentLocation~0=(_ bv2147483648 32), KbFilter_PnP_~Irp__Tail__Overlay__CurrentStackLocation~0=(_ bv2147483648 32), KbFilter_PnP_~irpStack__MinorFunction~0=(_ bv2 32), KbFilter_PnP_~irpStack~0=(_ bv2147483647 32), KbFilter_PnP_~status~0=(_ bv0 32), |KbFilter_PnP_#in~DeviceObject|=(_ bv0 32), |KbFilter_PnP_#in~Irp|=(_ bv0 32), |KbFilter_PnP_#t~ret13|=(_ bv3221225473 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv1 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv3221225473 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv4 32), ~UNLOADED~0=(_ bv0 32)] [?] havoc #t~ret13;~status~0 := 0bv32; VAL [KbFilter_PnP_~devExt__Removed~0=(_ bv1 32), KbFilter_PnP_~devExt__TopOfStack~0=(_ bv0 32), KbFilter_PnP_~devExt~0=(_ bv0 32), KbFilter_PnP_~DeviceObject=(_ bv0 32), KbFilter_PnP_~DeviceObject__DeviceExtension~0=(_ bv0 32), KbFilter_PnP_~event~0=(_ bv0 32), KbFilter_PnP_~Irp=(_ bv0 32), KbFilter_PnP_~Irp__CurrentLocation~0=(_ bv2147483648 32), KbFilter_PnP_~Irp__Tail__Overlay__CurrentStackLocation~0=(_ bv2147483648 32), KbFilter_PnP_~irpStack__MinorFunction~0=(_ bv2 32), KbFilter_PnP_~irpStack~0=(_ bv2147483647 32), KbFilter_PnP_~status~0=(_ bv0 32), |KbFilter_PnP_#in~DeviceObject|=(_ bv0 32), |KbFilter_PnP_#in~Irp|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv1 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv3221225473 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv4 32), ~UNLOADED~0=(_ bv0 32)] [?] #res := ~status~0; VAL [KbFilter_PnP_~devExt__Removed~0=(_ bv1 32), KbFilter_PnP_~devExt__TopOfStack~0=(_ bv0 32), KbFilter_PnP_~devExt~0=(_ bv0 32), KbFilter_PnP_~DeviceObject=(_ bv0 32), KbFilter_PnP_~DeviceObject__DeviceExtension~0=(_ bv0 32), KbFilter_PnP_~event~0=(_ bv0 32), KbFilter_PnP_~Irp=(_ bv0 32), KbFilter_PnP_~Irp__CurrentLocation~0=(_ bv2147483648 32), KbFilter_PnP_~Irp__Tail__Overlay__CurrentStackLocation~0=(_ bv2147483648 32), KbFilter_PnP_~irpStack__MinorFunction~0=(_ bv2 32), KbFilter_PnP_~irpStack~0=(_ bv2147483647 32), KbFilter_PnP_~status~0=(_ bv0 32), |KbFilter_PnP_#in~DeviceObject|=(_ bv0 32), |KbFilter_PnP_#in~Irp|=(_ bv0 32), |KbFilter_PnP_#res|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv1 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv3221225473 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv4 32), ~UNLOADED~0=(_ bv0 32)] [?] assume true; VAL [KbFilter_PnP_~devExt__Removed~0=(_ bv1 32), KbFilter_PnP_~devExt__TopOfStack~0=(_ bv0 32), KbFilter_PnP_~devExt~0=(_ bv0 32), KbFilter_PnP_~DeviceObject=(_ bv0 32), KbFilter_PnP_~DeviceObject__DeviceExtension~0=(_ bv0 32), KbFilter_PnP_~event~0=(_ bv0 32), KbFilter_PnP_~Irp=(_ bv0 32), KbFilter_PnP_~Irp__CurrentLocation~0=(_ bv2147483648 32), KbFilter_PnP_~Irp__Tail__Overlay__CurrentStackLocation~0=(_ bv2147483648 32), KbFilter_PnP_~irpStack__MinorFunction~0=(_ bv2 32), KbFilter_PnP_~irpStack~0=(_ bv2147483647 32), KbFilter_PnP_~status~0=(_ bv0 32), |KbFilter_PnP_#in~DeviceObject|=(_ bv0 32), |KbFilter_PnP_#in~Irp|=(_ bv0 32), |KbFilter_PnP_#res|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv1 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv3221225473 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv4 32), ~UNLOADED~0=(_ bv0 32)] [?] RET #725#return; VAL [main_~devobj~0=(_ bv0 32), main_~irp_choice~0=(_ bv1 32), main_~irp~0=(_ bv0 32), main_~pirp__IoStatus__Status~0=(_ bv0 32), main_~pirp~0=(_ bv0 32), main_~status~1=(_ bv0 32), main_~tmp_ndt_1~0=(_ bv1 32), main_~tmp_ndt_2~0=(_ bv0 32), main_~tmp_ndt_3~0=(_ bv3 32), |main_#t~ret27|=(_ bv0 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv3221225473 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv4 32), ~UNLOADED~0=(_ bv0 32)] [?] ~status~1 := #t~ret27;havoc #t~ret27; VAL [main_~devobj~0=(_ bv0 32), main_~irp_choice~0=(_ bv1 32), main_~irp~0=(_ bv0 32), main_~pirp__IoStatus__Status~0=(_ bv0 32), main_~pirp~0=(_ bv0 32), main_~status~1=(_ bv0 32), main_~tmp_ndt_1~0=(_ bv1 32), main_~tmp_ndt_2~0=(_ bv0 32), main_~tmp_ndt_3~0=(_ bv3 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv3221225473 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv4 32), ~UNLOADED~0=(_ bv0 32)] [?] assume !(1bv32 == ~pended~0); VAL [main_~devobj~0=(_ bv0 32), main_~irp_choice~0=(_ bv1 32), main_~irp~0=(_ bv0 32), main_~pirp__IoStatus__Status~0=(_ bv0 32), main_~pirp~0=(_ bv0 32), main_~status~1=(_ bv0 32), main_~tmp_ndt_1~0=(_ bv1 32), main_~tmp_ndt_2~0=(_ bv0 32), main_~tmp_ndt_3~0=(_ bv3 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv3221225473 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv4 32), ~UNLOADED~0=(_ bv0 32)] [?] assume !(1bv32 == ~pended~0); VAL [main_~devobj~0=(_ bv0 32), main_~irp_choice~0=(_ bv1 32), main_~irp~0=(_ bv0 32), main_~pirp__IoStatus__Status~0=(_ bv0 32), main_~pirp~0=(_ bv0 32), main_~status~1=(_ bv0 32), main_~tmp_ndt_1~0=(_ bv1 32), main_~tmp_ndt_2~0=(_ bv0 32), main_~tmp_ndt_3~0=(_ bv3 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv3221225473 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv4 32), ~UNLOADED~0=(_ bv0 32)] [?] assume ~s~0 != ~UNLOADED~0; VAL [main_~devobj~0=(_ bv0 32), main_~irp_choice~0=(_ bv1 32), main_~irp~0=(_ bv0 32), main_~pirp__IoStatus__Status~0=(_ bv0 32), main_~pirp~0=(_ bv0 32), main_~status~1=(_ bv0 32), main_~tmp_ndt_1~0=(_ bv1 32), main_~tmp_ndt_2~0=(_ bv0 32), main_~tmp_ndt_3~0=(_ bv3 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv3221225473 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv4 32), ~UNLOADED~0=(_ bv0 32)] [?] assume 4294967295bv32 != ~status~1; VAL [main_~devobj~0=(_ bv0 32), main_~irp_choice~0=(_ bv1 32), main_~irp~0=(_ bv0 32), main_~pirp__IoStatus__Status~0=(_ bv0 32), main_~pirp~0=(_ bv0 32), main_~status~1=(_ bv0 32), main_~tmp_ndt_1~0=(_ bv1 32), main_~tmp_ndt_2~0=(_ bv0 32), main_~tmp_ndt_3~0=(_ bv3 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv3221225473 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv4 32), ~UNLOADED~0=(_ bv0 32)] [?] assume !(~s~0 != ~SKIP2~0); VAL [main_~devobj~0=(_ bv0 32), main_~irp_choice~0=(_ bv1 32), main_~irp~0=(_ bv0 32), main_~pirp__IoStatus__Status~0=(_ bv0 32), main_~pirp~0=(_ bv0 32), main_~status~1=(_ bv0 32), main_~tmp_ndt_1~0=(_ bv1 32), main_~tmp_ndt_2~0=(_ bv0 32), main_~tmp_ndt_3~0=(_ bv3 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv3221225473 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv4 32), ~UNLOADED~0=(_ bv0 32)] [?] assume !(1bv32 == ~pended~0); VAL [main_~devobj~0=(_ bv0 32), main_~irp_choice~0=(_ bv1 32), main_~irp~0=(_ bv0 32), main_~pirp__IoStatus__Status~0=(_ bv0 32), main_~pirp~0=(_ bv0 32), main_~status~1=(_ bv0 32), main_~tmp_ndt_1~0=(_ bv1 32), main_~tmp_ndt_2~0=(_ bv0 32), main_~tmp_ndt_3~0=(_ bv3 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv3221225473 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv4 32), ~UNLOADED~0=(_ bv0 32)] [?] assume !(~s~0 == ~DC~0); VAL [main_~devobj~0=(_ bv0 32), main_~irp_choice~0=(_ bv1 32), main_~irp~0=(_ bv0 32), main_~pirp__IoStatus__Status~0=(_ bv0 32), main_~pirp~0=(_ bv0 32), main_~status~1=(_ bv0 32), main_~tmp_ndt_1~0=(_ bv1 32), main_~tmp_ndt_2~0=(_ bv0 32), main_~tmp_ndt_3~0=(_ bv3 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv3221225473 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv4 32), ~UNLOADED~0=(_ bv0 32)] [?] assume ~status~1 != ~lowerDriverReturn~0; VAL [main_~devobj~0=(_ bv0 32), main_~irp_choice~0=(_ bv1 32), main_~irp~0=(_ bv0 32), main_~pirp__IoStatus__Status~0=(_ bv0 32), main_~pirp~0=(_ bv0 32), main_~status~1=(_ bv0 32), main_~tmp_ndt_1~0=(_ bv1 32), main_~tmp_ndt_2~0=(_ bv0 32), main_~tmp_ndt_3~0=(_ bv3 32), |old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv3221225473 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv4 32), ~UNLOADED~0=(_ bv0 32)] [?] CALL call errorFn(); VAL [|old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv3221225473 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv4 32), ~UNLOADED~0=(_ bv0 32)] [?] assume !false; VAL [|old(~compFptr~0)|=(_ bv0 32), |old(~compRegistered~0)|=(_ bv0 32), |old(~customIrp~0)|=(_ bv0 32), |old(~DC~0)|=(_ bv0 32), |old(~DevicePowerState~0)|=(_ bv0 32), |old(~Executive~0)|=(_ bv0 32), |old(~IPC~0)|=(_ bv0 32), |old(~KernelMode~0)|=(_ bv0 32), |old(~lowerDriverReturn~0)|=(_ bv0 32), |old(~MPR1~0)|=(_ bv0 32), |old(~MPR3~0)|=(_ bv0 32), |old(~myStatus~0)|=(_ bv0 32), |old(~NP~0)|=(_ bv0 32), |old(~pended~0)|=(_ bv0 32), |old(~setEventCalled~0)|=(_ bv0 32), |old(~SKIP1~0)|=(_ bv0 32), |old(~SKIP2~0)|=(_ bv0 32), |old(~s~0)|=(_ bv0 32), |old(~UNLOADED~0)|=(_ bv0 32), ~compFptr~0=(_ bv0 32), ~compRegistered~0=(_ bv0 32), ~customIrp~0=(_ bv0 32), ~DC~0=(_ bv2 32), ~DevicePowerState~0=(_ bv1 32), ~Executive~0=(_ bv0 32), ~IPC~0=(_ bv7 32), ~KernelMode~0=(_ bv0 32), ~lowerDriverReturn~0=(_ bv3221225473 32), ~MPR1~0=(_ bv5 32), ~MPR3~0=(_ bv6 32), ~myStatus~0=(_ bv0 32), ~NP~0=(_ bv1 32), ~pended~0=(_ bv0 32), ~setEventCalled~0=(_ bv0 32), ~SKIP1~0=(_ bv3 32), ~SKIP2~0=(_ bv4 32), ~s~0=(_ bv4 32), ~UNLOADED~0=(_ bv0 32)] [?] CALL call ULTIMATE.init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L22] ~KernelMode~0 := 0bv32; [L23] ~Executive~0 := 0bv32; [L24] ~DevicePowerState~0 := 0bv32; [L25] ~s~0 := 0bv32; [L26] ~UNLOADED~0 := 0bv32; [L27] ~NP~0 := 0bv32; [L28] ~DC~0 := 0bv32; [L29] ~SKIP1~0 := 0bv32; [L30] ~SKIP2~0 := 0bv32; [L31] ~MPR1~0 := 0bv32; [L32] ~MPR3~0 := 0bv32; [L33] ~IPC~0 := 0bv32; [L34] ~pended~0 := 0bv32; [L35] ~compFptr~0 := 0bv32; [L36] ~compRegistered~0 := 0bv32; [L37] ~lowerDriverReturn~0 := 0bv32; [L38] ~setEventCalled~0 := 0bv32; [L39] ~customIrp~0 := 0bv32; [L40] ~myStatus~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [?] ensures true; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [?] RET call ULTIMATE.init(); VAL [~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [?] CALL call #t~ret77 := main(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L293] havoc ~status~1; [L294] ~irp~0 := #t~nondet17; [L294] havoc #t~nondet17; [L295] havoc ~pirp~0; [L296] havoc ~pirp__IoStatus__Status~0; [L297] ~irp_choice~0 := #t~nondet18; [L297] havoc #t~nondet18; [L298] ~devobj~0 := #t~nondet19; [L298] havoc #t~nondet19; [L299] havoc ~__cil_tmp8~0; [L301] ~KernelMode~0 := 0bv32; [L302] ~Executive~0 := 0bv32; [L303] ~DevicePowerState~0 := 1bv32; [L304] ~s~0 := 0bv32; [L305] ~UNLOADED~0 := 0bv32; [L306] ~NP~0 := 0bv32; [L307] ~DC~0 := 0bv32; [L308] ~SKIP1~0 := 0bv32; [L309] ~SKIP2~0 := 0bv32; [L310] ~MPR1~0 := 0bv32; [L311] ~MPR3~0 := 0bv32; [L312] ~IPC~0 := 0bv32; [L313] ~pended~0 := 0bv32; [L314] ~compFptr~0 := 0bv32; [L315] ~compRegistered~0 := 0bv32; [L316] ~lowerDriverReturn~0 := 0bv32; [L317] ~setEventCalled~0 := 0bv32; [L318] ~customIrp~0 := 0bv32; [L319] ~myStatus~0 := 0bv32; [L323] ~status~1 := 0bv32; [L324] ~pirp~0 := ~irp~0; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~status~1=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L325] CALL call _BLAST_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L60] ~UNLOADED~0 := 0bv32; [L61] ~NP~0 := 1bv32; [L62] ~DC~0 := 2bv32; [L63] ~SKIP1~0 := 3bv32; [L64] ~SKIP2~0 := 4bv32; [L65] ~MPR1~0 := 5bv32; [L66] ~MPR3~0 := 6bv32; [L67] ~IPC~0 := 7bv32; [L68] ~s~0 := ~UNLOADED~0; [L69] ~pended~0 := 0bv32; [L70] ~compFptr~0 := 0bv32; [L71] ~compRegistered~0 := 0bv32; [L72] ~lowerDriverReturn~0 := 0bv32; [L73] ~setEventCalled~0 := 0bv32; [L74] ~customIrp~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L56-L77] ensures true; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L325] RET call _BLAST_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L327-L410] assume ~bvsge32(~status~1, 0bv32); [L328] ~s~0 := ~NP~0; [L329] ~customIrp~0 := 0bv32; [L330] ~setEventCalled~0 := ~customIrp~0; [L331] ~lowerDriverReturn~0 := ~setEventCalled~0; [L332] ~compRegistered~0 := ~lowerDriverReturn~0; [L333] ~pended~0 := ~compRegistered~0; [L334] ~pirp__IoStatus__Status~0 := 0bv32; [L335] ~myStatus~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L336-L339] assume !(0bv32 == ~irp_choice~0); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L341] CALL call stub_driver_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L46] ~s~0 := ~NP~0; [L47] ~pended~0 := 0bv32; [L48] ~compFptr~0 := 0bv32; [L49] ~compRegistered~0 := 0bv32; [L50] ~lowerDriverReturn~0 := 0bv32; [L51] ~setEventCalled~0 := 0bv32; [L52] ~customIrp~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L42-L55] ensures true; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L341] RET call stub_driver_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L344-L346] assume !~bvslt32(~status~1, 0bv32); [L348] havoc ~tmp_ndt_1~0; [L349] ~tmp_ndt_1~0 := #t~nondet20; [L349] havoc #t~nondet20; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~UNLOADED~0=0bv32] [L350-L409] assume !(0bv32 == ~tmp_ndt_1~0); [L353] havoc ~tmp_ndt_2~0; [L354] ~tmp_ndt_2~0 := #t~nondet21; [L354] havoc #t~nondet21; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~UNLOADED~0=0bv32] [L355-L408] assume !(1bv32 == ~tmp_ndt_2~0); [L358] havoc ~tmp_ndt_3~0; [L359] ~tmp_ndt_3~0 := #t~nondet22; [L359] havoc #t~nondet22; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L360-L407] assume 3bv32 == ~tmp_ndt_3~0; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L387] CALL call #t~ret27 := KbFilter_PnP(~devobj~0, ~pirp~0); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L78-L291] ~DeviceObject := #in~DeviceObject; [L78-L291] ~Irp := #in~Irp; [L79] havoc ~devExt~0; [L80] havoc ~irpStack~0; [L81] havoc ~status~0; [L82] ~event~0 := #t~nondet0; [L82] havoc #t~nondet0; [L83] ~DeviceObject__DeviceExtension~0 := #t~nondet1; [L83] havoc #t~nondet1; [L84] ~Irp__Tail__Overlay__CurrentStackLocation~0 := #t~nondet2; [L84] havoc #t~nondet2; [L85] ~irpStack__MinorFunction~0 := #t~nondet3; [L85] havoc #t~nondet3; [L86] ~devExt__TopOfStack~0 := #t~nondet4; [L86] havoc #t~nondet4; [L87] havoc ~devExt__Started~0; [L88] havoc ~devExt__Removed~0; [L89] havoc ~devExt__SurpriseRemoved~0; [L90] havoc ~Irp__IoStatus__Status~0; [L91] havoc ~Irp__IoStatus__Information~0; [L92] ~Irp__CurrentLocation~0 := #t~nondet5; [L92] havoc #t~nondet5; [L93] havoc ~irpSp~0; [L94] havoc ~nextIrpSp~0; [L95] havoc ~nextIrpSp__Control~0; [L96] havoc ~irpSp___0~0; [L97] havoc ~irpSp__Context~0; [L98] havoc ~irpSp__Control~0; [L99] havoc ~__cil_tmp23~0; [L102] ~status~0 := 0bv32; [L103] ~devExt~0 := ~DeviceObject__DeviceExtension~0; [L104] ~irpStack~0 := ~Irp__Tail__Overlay__CurrentStackLocation~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L105-L288] assume !(0bv32 == ~irpStack__MinorFunction~0); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L108-L287] assume !(23bv32 == ~irpStack__MinorFunction~0); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L111-L286] assume 2bv32 == ~irpStack__MinorFunction~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L235] ~devExt__Removed~0 := 1bv32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L236-L242] assume ~s~0 == ~NP~0; [L237] ~s~0 := ~SKIP1~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L244] #t~post11 := ~Irp__CurrentLocation~0; [L244] ~Irp__CurrentLocation~0 := ~bvadd32(1bv32, #t~post11); [L244] havoc #t~post11; [L245] #t~post12 := ~Irp__Tail__Overlay__CurrentStackLocation~0; [L245] ~Irp__Tail__Overlay__CurrentStackLocation~0 := ~bvadd32(1bv32, #t~post12); [L245] havoc #t~post12; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L246] CALL call #t~ret13 := IofCallDriver(~devExt__TopOfStack~0, ~Irp); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L480-L552] ~DeviceObject := #in~DeviceObject; [L480-L552] ~Irp := #in~Irp; [L482] havoc ~returnVal2~0; [L483] havoc ~compRetStatus~0; [L484] ~lcontext~0 := #t~nondet30; [L484] havoc #t~nondet30; [L485] havoc ~__cil_tmp7~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L488-L500] assume !(0bv32 != ~compRegistered~0); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L501] havoc ~tmp_ndt_6~0; [L502] ~tmp_ndt_6~0 := #t~nondet32; [L502] havoc #t~nondet32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~UNLOADED~0=0bv32] [L503-L526] assume !(0bv32 == ~tmp_ndt_6~0); [L506] havoc ~tmp_ndt_7~0; [L507] ~tmp_ndt_7~0 := #t~nondet33; [L507] havoc #t~nondet33; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L508-L525] assume 1bv32 == ~tmp_ndt_7~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L517] ~returnVal2~0 := 3221225473bv32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L527-L549] assume !(~s~0 == ~NP~0); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L531-L548] assume !(~s~0 == ~MPR1~0); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L540-L547] assume ~s~0 == ~SKIP1~0; [L541] ~s~0 := ~SKIP2~0; [L542] ~lowerDriverReturn~0 := ~returnVal2~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L550] #res := ~returnVal2~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #res=3221225473bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L9] ensures true; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #res=3221225473bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L246] RET call #t~ret13 := IofCallDriver(~devExt__TopOfStack~0, ~Irp); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #t~ret13=3221225473bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L246] havoc #t~ret13; [L247] ~status~0 := 0bv32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L289] #res := ~status~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #res=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L8] ensures true; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #res=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L387] RET call #t~ret27 := KbFilter_PnP(~devobj~0, ~pirp~0); VAL [#t~ret27=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L387] ~status~1 := #t~ret27; [L387] havoc #t~ret27; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L411-L462] assume !(1bv32 == ~pended~0); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L419-L461] assume !(1bv32 == ~pended~0); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L427-L460] assume ~s~0 != ~UNLOADED~0; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L428-L459] assume 4294967295bv32 != ~status~1; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L429-L458] assume !(~s~0 != ~SKIP2~0); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L439-L457] assume !(1bv32 == ~pended~0); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L446-L456] assume !(~s~0 == ~DC~0); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L451-L455] assume ~status~1 != ~lowerDriverReturn~0; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L452] CALL call errorFn(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L1012] assert false; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] ----- ----- class de.uni_freiburg.informatik.ultimate.boogie.preprocessor.BoogiePreprocessorBacktranslator [?] CALL call ULTIMATE.init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L22] ~KernelMode~0 := 0bv32; [L23] ~Executive~0 := 0bv32; [L24] ~DevicePowerState~0 := 0bv32; [L25] ~s~0 := 0bv32; [L26] ~UNLOADED~0 := 0bv32; [L27] ~NP~0 := 0bv32; [L28] ~DC~0 := 0bv32; [L29] ~SKIP1~0 := 0bv32; [L30] ~SKIP2~0 := 0bv32; [L31] ~MPR1~0 := 0bv32; [L32] ~MPR3~0 := 0bv32; [L33] ~IPC~0 := 0bv32; [L34] ~pended~0 := 0bv32; [L35] ~compFptr~0 := 0bv32; [L36] ~compRegistered~0 := 0bv32; [L37] ~lowerDriverReturn~0 := 0bv32; [L38] ~setEventCalled~0 := 0bv32; [L39] ~customIrp~0 := 0bv32; [L40] ~myStatus~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [?] ensures true; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [?] RET call ULTIMATE.init(); VAL [~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [?] CALL call #t~ret77 := main(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L293] havoc ~status~1; [L294] ~irp~0 := #t~nondet17; [L294] havoc #t~nondet17; [L295] havoc ~pirp~0; [L296] havoc ~pirp__IoStatus__Status~0; [L297] ~irp_choice~0 := #t~nondet18; [L297] havoc #t~nondet18; [L298] ~devobj~0 := #t~nondet19; [L298] havoc #t~nondet19; [L299] havoc ~__cil_tmp8~0; [L301] ~KernelMode~0 := 0bv32; [L302] ~Executive~0 := 0bv32; [L303] ~DevicePowerState~0 := 1bv32; [L304] ~s~0 := 0bv32; [L305] ~UNLOADED~0 := 0bv32; [L306] ~NP~0 := 0bv32; [L307] ~DC~0 := 0bv32; [L308] ~SKIP1~0 := 0bv32; [L309] ~SKIP2~0 := 0bv32; [L310] ~MPR1~0 := 0bv32; [L311] ~MPR3~0 := 0bv32; [L312] ~IPC~0 := 0bv32; [L313] ~pended~0 := 0bv32; [L314] ~compFptr~0 := 0bv32; [L315] ~compRegistered~0 := 0bv32; [L316] ~lowerDriverReturn~0 := 0bv32; [L317] ~setEventCalled~0 := 0bv32; [L318] ~customIrp~0 := 0bv32; [L319] ~myStatus~0 := 0bv32; [L323] ~status~1 := 0bv32; [L324] ~pirp~0 := ~irp~0; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~status~1=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L325] CALL call _BLAST_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L60] ~UNLOADED~0 := 0bv32; [L61] ~NP~0 := 1bv32; [L62] ~DC~0 := 2bv32; [L63] ~SKIP1~0 := 3bv32; [L64] ~SKIP2~0 := 4bv32; [L65] ~MPR1~0 := 5bv32; [L66] ~MPR3~0 := 6bv32; [L67] ~IPC~0 := 7bv32; [L68] ~s~0 := ~UNLOADED~0; [L69] ~pended~0 := 0bv32; [L70] ~compFptr~0 := 0bv32; [L71] ~compRegistered~0 := 0bv32; [L72] ~lowerDriverReturn~0 := 0bv32; [L73] ~setEventCalled~0 := 0bv32; [L74] ~customIrp~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L56-L77] ensures true; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L325] RET call _BLAST_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L327-L410] assume ~bvsge32(~status~1, 0bv32); [L328] ~s~0 := ~NP~0; [L329] ~customIrp~0 := 0bv32; [L330] ~setEventCalled~0 := ~customIrp~0; [L331] ~lowerDriverReturn~0 := ~setEventCalled~0; [L332] ~compRegistered~0 := ~lowerDriverReturn~0; [L333] ~pended~0 := ~compRegistered~0; [L334] ~pirp__IoStatus__Status~0 := 0bv32; [L335] ~myStatus~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L336-L339] assume !(0bv32 == ~irp_choice~0); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L341] CALL call stub_driver_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L46] ~s~0 := ~NP~0; [L47] ~pended~0 := 0bv32; [L48] ~compFptr~0 := 0bv32; [L49] ~compRegistered~0 := 0bv32; [L50] ~lowerDriverReturn~0 := 0bv32; [L51] ~setEventCalled~0 := 0bv32; [L52] ~customIrp~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L42-L55] ensures true; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L341] RET call stub_driver_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L344-L346] assume !~bvslt32(~status~1, 0bv32); [L348] havoc ~tmp_ndt_1~0; [L349] ~tmp_ndt_1~0 := #t~nondet20; [L349] havoc #t~nondet20; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~UNLOADED~0=0bv32] [L350-L409] assume !(0bv32 == ~tmp_ndt_1~0); [L353] havoc ~tmp_ndt_2~0; [L354] ~tmp_ndt_2~0 := #t~nondet21; [L354] havoc #t~nondet21; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~UNLOADED~0=0bv32] [L355-L408] assume !(1bv32 == ~tmp_ndt_2~0); [L358] havoc ~tmp_ndt_3~0; [L359] ~tmp_ndt_3~0 := #t~nondet22; [L359] havoc #t~nondet22; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L360-L407] assume 3bv32 == ~tmp_ndt_3~0; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L387] CALL call #t~ret27 := KbFilter_PnP(~devobj~0, ~pirp~0); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L78-L291] ~DeviceObject := #in~DeviceObject; [L78-L291] ~Irp := #in~Irp; [L79] havoc ~devExt~0; [L80] havoc ~irpStack~0; [L81] havoc ~status~0; [L82] ~event~0 := #t~nondet0; [L82] havoc #t~nondet0; [L83] ~DeviceObject__DeviceExtension~0 := #t~nondet1; [L83] havoc #t~nondet1; [L84] ~Irp__Tail__Overlay__CurrentStackLocation~0 := #t~nondet2; [L84] havoc #t~nondet2; [L85] ~irpStack__MinorFunction~0 := #t~nondet3; [L85] havoc #t~nondet3; [L86] ~devExt__TopOfStack~0 := #t~nondet4; [L86] havoc #t~nondet4; [L87] havoc ~devExt__Started~0; [L88] havoc ~devExt__Removed~0; [L89] havoc ~devExt__SurpriseRemoved~0; [L90] havoc ~Irp__IoStatus__Status~0; [L91] havoc ~Irp__IoStatus__Information~0; [L92] ~Irp__CurrentLocation~0 := #t~nondet5; [L92] havoc #t~nondet5; [L93] havoc ~irpSp~0; [L94] havoc ~nextIrpSp~0; [L95] havoc ~nextIrpSp__Control~0; [L96] havoc ~irpSp___0~0; [L97] havoc ~irpSp__Context~0; [L98] havoc ~irpSp__Control~0; [L99] havoc ~__cil_tmp23~0; [L102] ~status~0 := 0bv32; [L103] ~devExt~0 := ~DeviceObject__DeviceExtension~0; [L104] ~irpStack~0 := ~Irp__Tail__Overlay__CurrentStackLocation~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L105-L288] assume !(0bv32 == ~irpStack__MinorFunction~0); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L108-L287] assume !(23bv32 == ~irpStack__MinorFunction~0); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L111-L286] assume 2bv32 == ~irpStack__MinorFunction~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L235] ~devExt__Removed~0 := 1bv32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L236-L242] assume ~s~0 == ~NP~0; [L237] ~s~0 := ~SKIP1~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L244] #t~post11 := ~Irp__CurrentLocation~0; [L244] ~Irp__CurrentLocation~0 := ~bvadd32(1bv32, #t~post11); [L244] havoc #t~post11; [L245] #t~post12 := ~Irp__Tail__Overlay__CurrentStackLocation~0; [L245] ~Irp__Tail__Overlay__CurrentStackLocation~0 := ~bvadd32(1bv32, #t~post12); [L245] havoc #t~post12; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L246] CALL call #t~ret13 := IofCallDriver(~devExt__TopOfStack~0, ~Irp); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L480-L552] ~DeviceObject := #in~DeviceObject; [L480-L552] ~Irp := #in~Irp; [L482] havoc ~returnVal2~0; [L483] havoc ~compRetStatus~0; [L484] ~lcontext~0 := #t~nondet30; [L484] havoc #t~nondet30; [L485] havoc ~__cil_tmp7~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L488-L500] assume !(0bv32 != ~compRegistered~0); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L501] havoc ~tmp_ndt_6~0; [L502] ~tmp_ndt_6~0 := #t~nondet32; [L502] havoc #t~nondet32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~UNLOADED~0=0bv32] [L503-L526] assume !(0bv32 == ~tmp_ndt_6~0); [L506] havoc ~tmp_ndt_7~0; [L507] ~tmp_ndt_7~0 := #t~nondet33; [L507] havoc #t~nondet33; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L508-L525] assume 1bv32 == ~tmp_ndt_7~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L517] ~returnVal2~0 := 3221225473bv32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L527-L549] assume !(~s~0 == ~NP~0); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L531-L548] assume !(~s~0 == ~MPR1~0); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L540-L547] assume ~s~0 == ~SKIP1~0; [L541] ~s~0 := ~SKIP2~0; [L542] ~lowerDriverReturn~0 := ~returnVal2~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L550] #res := ~returnVal2~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #res=3221225473bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L9] ensures true; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #res=3221225473bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L246] RET call #t~ret13 := IofCallDriver(~devExt__TopOfStack~0, ~Irp); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #t~ret13=3221225473bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L246] havoc #t~ret13; [L247] ~status~0 := 0bv32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L289] #res := ~status~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #res=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L8] ensures true; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #res=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L387] RET call #t~ret27 := KbFilter_PnP(~devobj~0, ~pirp~0); VAL [#t~ret27=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L387] ~status~1 := #t~ret27; [L387] havoc #t~ret27; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L411-L462] assume !(1bv32 == ~pended~0); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L419-L461] assume !(1bv32 == ~pended~0); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L427-L460] assume ~s~0 != ~UNLOADED~0; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L428-L459] assume 4294967295bv32 != ~status~1; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L429-L458] assume !(~s~0 != ~SKIP2~0); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L439-L457] assume !(1bv32 == ~pended~0); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L446-L456] assume !(~s~0 == ~DC~0); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L451-L455] assume ~status~1 != ~lowerDriverReturn~0; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L452] CALL call errorFn(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L1012] assert false; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [?] CALL call ULTIMATE.init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L22] ~KernelMode~0 := 0bv32; [L23] ~Executive~0 := 0bv32; [L24] ~DevicePowerState~0 := 0bv32; [L25] ~s~0 := 0bv32; [L26] ~UNLOADED~0 := 0bv32; [L27] ~NP~0 := 0bv32; [L28] ~DC~0 := 0bv32; [L29] ~SKIP1~0 := 0bv32; [L30] ~SKIP2~0 := 0bv32; [L31] ~MPR1~0 := 0bv32; [L32] ~MPR3~0 := 0bv32; [L33] ~IPC~0 := 0bv32; [L34] ~pended~0 := 0bv32; [L35] ~compFptr~0 := 0bv32; [L36] ~compRegistered~0 := 0bv32; [L37] ~lowerDriverReturn~0 := 0bv32; [L38] ~setEventCalled~0 := 0bv32; [L39] ~customIrp~0 := 0bv32; [L40] ~myStatus~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [?] RET call ULTIMATE.init(); VAL [~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [?] CALL call #t~ret77 := main(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L293] havoc ~status~1; [L294] ~irp~0 := #t~nondet17; [L294] havoc #t~nondet17; [L295] havoc ~pirp~0; [L296] havoc ~pirp__IoStatus__Status~0; [L297] ~irp_choice~0 := #t~nondet18; [L297] havoc #t~nondet18; [L298] ~devobj~0 := #t~nondet19; [L298] havoc #t~nondet19; [L299] havoc ~__cil_tmp8~0; [L301] ~KernelMode~0 := 0bv32; [L302] ~Executive~0 := 0bv32; [L303] ~DevicePowerState~0 := 1bv32; [L304] ~s~0 := 0bv32; [L305] ~UNLOADED~0 := 0bv32; [L306] ~NP~0 := 0bv32; [L307] ~DC~0 := 0bv32; [L308] ~SKIP1~0 := 0bv32; [L309] ~SKIP2~0 := 0bv32; [L310] ~MPR1~0 := 0bv32; [L311] ~MPR3~0 := 0bv32; [L312] ~IPC~0 := 0bv32; [L313] ~pended~0 := 0bv32; [L314] ~compFptr~0 := 0bv32; [L315] ~compRegistered~0 := 0bv32; [L316] ~lowerDriverReturn~0 := 0bv32; [L317] ~setEventCalled~0 := 0bv32; [L318] ~customIrp~0 := 0bv32; [L319] ~myStatus~0 := 0bv32; [L323] ~status~1 := 0bv32; [L324] ~pirp~0 := ~irp~0; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~status~1=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L325] CALL call _BLAST_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L60] ~UNLOADED~0 := 0bv32; [L61] ~NP~0 := 1bv32; [L62] ~DC~0 := 2bv32; [L63] ~SKIP1~0 := 3bv32; [L64] ~SKIP2~0 := 4bv32; [L65] ~MPR1~0 := 5bv32; [L66] ~MPR3~0 := 6bv32; [L67] ~IPC~0 := 7bv32; [L68] ~s~0 := ~UNLOADED~0; [L69] ~pended~0 := 0bv32; [L70] ~compFptr~0 := 0bv32; [L71] ~compRegistered~0 := 0bv32; [L72] ~lowerDriverReturn~0 := 0bv32; [L73] ~setEventCalled~0 := 0bv32; [L74] ~customIrp~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L325] RET call _BLAST_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L327] COND TRUE ~bvsge32(~status~1, 0bv32) [L328] ~s~0 := ~NP~0; [L329] ~customIrp~0 := 0bv32; [L330] ~setEventCalled~0 := ~customIrp~0; [L331] ~lowerDriverReturn~0 := ~setEventCalled~0; [L332] ~compRegistered~0 := ~lowerDriverReturn~0; [L333] ~pended~0 := ~compRegistered~0; [L334] ~pirp__IoStatus__Status~0 := 0bv32; [L335] ~myStatus~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L336] COND FALSE !(0bv32 == ~irp_choice~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L341] CALL call stub_driver_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L46] ~s~0 := ~NP~0; [L47] ~pended~0 := 0bv32; [L48] ~compFptr~0 := 0bv32; [L49] ~compRegistered~0 := 0bv32; [L50] ~lowerDriverReturn~0 := 0bv32; [L51] ~setEventCalled~0 := 0bv32; [L52] ~customIrp~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L341] RET call stub_driver_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L344] COND FALSE !(~bvslt32(~status~1, 0bv32)) [L348] havoc ~tmp_ndt_1~0; [L349] ~tmp_ndt_1~0 := #t~nondet20; [L349] havoc #t~nondet20; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~UNLOADED~0=0bv32] [L350] COND FALSE !(0bv32 == ~tmp_ndt_1~0) [L353] havoc ~tmp_ndt_2~0; [L354] ~tmp_ndt_2~0 := #t~nondet21; [L354] havoc #t~nondet21; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~UNLOADED~0=0bv32] [L355] COND FALSE !(1bv32 == ~tmp_ndt_2~0) [L358] havoc ~tmp_ndt_3~0; [L359] ~tmp_ndt_3~0 := #t~nondet22; [L359] havoc #t~nondet22; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L360] COND TRUE 3bv32 == ~tmp_ndt_3~0 VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L387] CALL call #t~ret27 := KbFilter_PnP(~devobj~0, ~pirp~0); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L78-L291] ~DeviceObject := #in~DeviceObject; [L78-L291] ~Irp := #in~Irp; [L79] havoc ~devExt~0; [L80] havoc ~irpStack~0; [L81] havoc ~status~0; [L82] ~event~0 := #t~nondet0; [L82] havoc #t~nondet0; [L83] ~DeviceObject__DeviceExtension~0 := #t~nondet1; [L83] havoc #t~nondet1; [L84] ~Irp__Tail__Overlay__CurrentStackLocation~0 := #t~nondet2; [L84] havoc #t~nondet2; [L85] ~irpStack__MinorFunction~0 := #t~nondet3; [L85] havoc #t~nondet3; [L86] ~devExt__TopOfStack~0 := #t~nondet4; [L86] havoc #t~nondet4; [L87] havoc ~devExt__Started~0; [L88] havoc ~devExt__Removed~0; [L89] havoc ~devExt__SurpriseRemoved~0; [L90] havoc ~Irp__IoStatus__Status~0; [L91] havoc ~Irp__IoStatus__Information~0; [L92] ~Irp__CurrentLocation~0 := #t~nondet5; [L92] havoc #t~nondet5; [L93] havoc ~irpSp~0; [L94] havoc ~nextIrpSp~0; [L95] havoc ~nextIrpSp__Control~0; [L96] havoc ~irpSp___0~0; [L97] havoc ~irpSp__Context~0; [L98] havoc ~irpSp__Control~0; [L99] havoc ~__cil_tmp23~0; [L102] ~status~0 := 0bv32; [L103] ~devExt~0 := ~DeviceObject__DeviceExtension~0; [L104] ~irpStack~0 := ~Irp__Tail__Overlay__CurrentStackLocation~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L105] COND FALSE !(0bv32 == ~irpStack__MinorFunction~0) VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L108] COND FALSE !(23bv32 == ~irpStack__MinorFunction~0) VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L111] COND TRUE 2bv32 == ~irpStack__MinorFunction~0 VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L235] ~devExt__Removed~0 := 1bv32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L236] COND TRUE ~s~0 == ~NP~0 [L237] ~s~0 := ~SKIP1~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L244] #t~post11 := ~Irp__CurrentLocation~0; [L244] ~Irp__CurrentLocation~0 := ~bvadd32(1bv32, #t~post11); [L244] havoc #t~post11; [L245] #t~post12 := ~Irp__Tail__Overlay__CurrentStackLocation~0; [L245] ~Irp__Tail__Overlay__CurrentStackLocation~0 := ~bvadd32(1bv32, #t~post12); [L245] havoc #t~post12; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L246] CALL call #t~ret13 := IofCallDriver(~devExt__TopOfStack~0, ~Irp); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L480-L552] ~DeviceObject := #in~DeviceObject; [L480-L552] ~Irp := #in~Irp; [L482] havoc ~returnVal2~0; [L483] havoc ~compRetStatus~0; [L484] ~lcontext~0 := #t~nondet30; [L484] havoc #t~nondet30; [L485] havoc ~__cil_tmp7~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L488-L500] COND FALSE !(0bv32 != ~compRegistered~0) VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L501] havoc ~tmp_ndt_6~0; [L502] ~tmp_ndt_6~0 := #t~nondet32; [L502] havoc #t~nondet32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~UNLOADED~0=0bv32] [L503] COND FALSE !(0bv32 == ~tmp_ndt_6~0) [L506] havoc ~tmp_ndt_7~0; [L507] ~tmp_ndt_7~0 := #t~nondet33; [L507] havoc #t~nondet33; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L508] COND TRUE 1bv32 == ~tmp_ndt_7~0 VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L517] ~returnVal2~0 := 3221225473bv32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L527] COND FALSE !(~s~0 == ~NP~0) VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L531] COND FALSE !(~s~0 == ~MPR1~0) VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L540] COND TRUE ~s~0 == ~SKIP1~0 [L541] ~s~0 := ~SKIP2~0; [L542] ~lowerDriverReturn~0 := ~returnVal2~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L550] #res := ~returnVal2~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #res=3221225473bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L246] RET call #t~ret13 := IofCallDriver(~devExt__TopOfStack~0, ~Irp); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #t~ret13=3221225473bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L246] havoc #t~ret13; [L247] ~status~0 := 0bv32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L289] #res := ~status~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #res=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L387] RET call #t~ret27 := KbFilter_PnP(~devobj~0, ~pirp~0); VAL [#t~ret27=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L387] ~status~1 := #t~ret27; [L387] havoc #t~ret27; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L411] COND FALSE !(1bv32 == ~pended~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L419] COND FALSE !(1bv32 == ~pended~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L427] COND TRUE ~s~0 != ~UNLOADED~0 VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L428] COND TRUE 4294967295bv32 != ~status~1 VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L429] COND FALSE !(~s~0 != ~SKIP2~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L439] COND FALSE !(1bv32 == ~pended~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L446] COND FALSE !(~s~0 == ~DC~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L451] COND TRUE ~status~1 != ~lowerDriverReturn~0 VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L452] CALL call errorFn(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L1012] assert false; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] ----- ----- class de.uni_freiburg.informatik.ultimate.boogie.procedureinliner.backtranslation.InlinerBacktranslator [?] CALL call ULTIMATE.init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L22] ~KernelMode~0 := 0bv32; [L23] ~Executive~0 := 0bv32; [L24] ~DevicePowerState~0 := 0bv32; [L25] ~s~0 := 0bv32; [L26] ~UNLOADED~0 := 0bv32; [L27] ~NP~0 := 0bv32; [L28] ~DC~0 := 0bv32; [L29] ~SKIP1~0 := 0bv32; [L30] ~SKIP2~0 := 0bv32; [L31] ~MPR1~0 := 0bv32; [L32] ~MPR3~0 := 0bv32; [L33] ~IPC~0 := 0bv32; [L34] ~pended~0 := 0bv32; [L35] ~compFptr~0 := 0bv32; [L36] ~compRegistered~0 := 0bv32; [L37] ~lowerDriverReturn~0 := 0bv32; [L38] ~setEventCalled~0 := 0bv32; [L39] ~customIrp~0 := 0bv32; [L40] ~myStatus~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [?] RET call ULTIMATE.init(); VAL [~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [?] CALL call #t~ret77 := main(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L293] havoc ~status~1; [L294] ~irp~0 := #t~nondet17; [L294] havoc #t~nondet17; [L295] havoc ~pirp~0; [L296] havoc ~pirp__IoStatus__Status~0; [L297] ~irp_choice~0 := #t~nondet18; [L297] havoc #t~nondet18; [L298] ~devobj~0 := #t~nondet19; [L298] havoc #t~nondet19; [L299] havoc ~__cil_tmp8~0; [L301] ~KernelMode~0 := 0bv32; [L302] ~Executive~0 := 0bv32; [L303] ~DevicePowerState~0 := 1bv32; [L304] ~s~0 := 0bv32; [L305] ~UNLOADED~0 := 0bv32; [L306] ~NP~0 := 0bv32; [L307] ~DC~0 := 0bv32; [L308] ~SKIP1~0 := 0bv32; [L309] ~SKIP2~0 := 0bv32; [L310] ~MPR1~0 := 0bv32; [L311] ~MPR3~0 := 0bv32; [L312] ~IPC~0 := 0bv32; [L313] ~pended~0 := 0bv32; [L314] ~compFptr~0 := 0bv32; [L315] ~compRegistered~0 := 0bv32; [L316] ~lowerDriverReturn~0 := 0bv32; [L317] ~setEventCalled~0 := 0bv32; [L318] ~customIrp~0 := 0bv32; [L319] ~myStatus~0 := 0bv32; [L323] ~status~1 := 0bv32; [L324] ~pirp~0 := ~irp~0; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~status~1=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L325] CALL call _BLAST_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L60] ~UNLOADED~0 := 0bv32; [L61] ~NP~0 := 1bv32; [L62] ~DC~0 := 2bv32; [L63] ~SKIP1~0 := 3bv32; [L64] ~SKIP2~0 := 4bv32; [L65] ~MPR1~0 := 5bv32; [L66] ~MPR3~0 := 6bv32; [L67] ~IPC~0 := 7bv32; [L68] ~s~0 := ~UNLOADED~0; [L69] ~pended~0 := 0bv32; [L70] ~compFptr~0 := 0bv32; [L71] ~compRegistered~0 := 0bv32; [L72] ~lowerDriverReturn~0 := 0bv32; [L73] ~setEventCalled~0 := 0bv32; [L74] ~customIrp~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L325] RET call _BLAST_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L327] COND TRUE ~bvsge32(~status~1, 0bv32) [L328] ~s~0 := ~NP~0; [L329] ~customIrp~0 := 0bv32; [L330] ~setEventCalled~0 := ~customIrp~0; [L331] ~lowerDriverReturn~0 := ~setEventCalled~0; [L332] ~compRegistered~0 := ~lowerDriverReturn~0; [L333] ~pended~0 := ~compRegistered~0; [L334] ~pirp__IoStatus__Status~0 := 0bv32; [L335] ~myStatus~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L336] COND FALSE !(0bv32 == ~irp_choice~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L341] CALL call stub_driver_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L46] ~s~0 := ~NP~0; [L47] ~pended~0 := 0bv32; [L48] ~compFptr~0 := 0bv32; [L49] ~compRegistered~0 := 0bv32; [L50] ~lowerDriverReturn~0 := 0bv32; [L51] ~setEventCalled~0 := 0bv32; [L52] ~customIrp~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L341] RET call stub_driver_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L344] COND FALSE !(~bvslt32(~status~1, 0bv32)) [L348] havoc ~tmp_ndt_1~0; [L349] ~tmp_ndt_1~0 := #t~nondet20; [L349] havoc #t~nondet20; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~UNLOADED~0=0bv32] [L350] COND FALSE !(0bv32 == ~tmp_ndt_1~0) [L353] havoc ~tmp_ndt_2~0; [L354] ~tmp_ndt_2~0 := #t~nondet21; [L354] havoc #t~nondet21; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~UNLOADED~0=0bv32] [L355] COND FALSE !(1bv32 == ~tmp_ndt_2~0) [L358] havoc ~tmp_ndt_3~0; [L359] ~tmp_ndt_3~0 := #t~nondet22; [L359] havoc #t~nondet22; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L360] COND TRUE 3bv32 == ~tmp_ndt_3~0 VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L387] CALL call #t~ret27 := KbFilter_PnP(~devobj~0, ~pirp~0); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L78-L291] ~DeviceObject := #in~DeviceObject; [L78-L291] ~Irp := #in~Irp; [L79] havoc ~devExt~0; [L80] havoc ~irpStack~0; [L81] havoc ~status~0; [L82] ~event~0 := #t~nondet0; [L82] havoc #t~nondet0; [L83] ~DeviceObject__DeviceExtension~0 := #t~nondet1; [L83] havoc #t~nondet1; [L84] ~Irp__Tail__Overlay__CurrentStackLocation~0 := #t~nondet2; [L84] havoc #t~nondet2; [L85] ~irpStack__MinorFunction~0 := #t~nondet3; [L85] havoc #t~nondet3; [L86] ~devExt__TopOfStack~0 := #t~nondet4; [L86] havoc #t~nondet4; [L87] havoc ~devExt__Started~0; [L88] havoc ~devExt__Removed~0; [L89] havoc ~devExt__SurpriseRemoved~0; [L90] havoc ~Irp__IoStatus__Status~0; [L91] havoc ~Irp__IoStatus__Information~0; [L92] ~Irp__CurrentLocation~0 := #t~nondet5; [L92] havoc #t~nondet5; [L93] havoc ~irpSp~0; [L94] havoc ~nextIrpSp~0; [L95] havoc ~nextIrpSp__Control~0; [L96] havoc ~irpSp___0~0; [L97] havoc ~irpSp__Context~0; [L98] havoc ~irpSp__Control~0; [L99] havoc ~__cil_tmp23~0; [L102] ~status~0 := 0bv32; [L103] ~devExt~0 := ~DeviceObject__DeviceExtension~0; [L104] ~irpStack~0 := ~Irp__Tail__Overlay__CurrentStackLocation~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L105] COND FALSE !(0bv32 == ~irpStack__MinorFunction~0) VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L108] COND FALSE !(23bv32 == ~irpStack__MinorFunction~0) VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L111] COND TRUE 2bv32 == ~irpStack__MinorFunction~0 VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L235] ~devExt__Removed~0 := 1bv32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L236] COND TRUE ~s~0 == ~NP~0 [L237] ~s~0 := ~SKIP1~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L244] #t~post11 := ~Irp__CurrentLocation~0; [L244] ~Irp__CurrentLocation~0 := ~bvadd32(1bv32, #t~post11); [L244] havoc #t~post11; [L245] #t~post12 := ~Irp__Tail__Overlay__CurrentStackLocation~0; [L245] ~Irp__Tail__Overlay__CurrentStackLocation~0 := ~bvadd32(1bv32, #t~post12); [L245] havoc #t~post12; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L246] CALL call #t~ret13 := IofCallDriver(~devExt__TopOfStack~0, ~Irp); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L480-L552] ~DeviceObject := #in~DeviceObject; [L480-L552] ~Irp := #in~Irp; [L482] havoc ~returnVal2~0; [L483] havoc ~compRetStatus~0; [L484] ~lcontext~0 := #t~nondet30; [L484] havoc #t~nondet30; [L485] havoc ~__cil_tmp7~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L488-L500] COND FALSE !(0bv32 != ~compRegistered~0) VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L501] havoc ~tmp_ndt_6~0; [L502] ~tmp_ndt_6~0 := #t~nondet32; [L502] havoc #t~nondet32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~UNLOADED~0=0bv32] [L503] COND FALSE !(0bv32 == ~tmp_ndt_6~0) [L506] havoc ~tmp_ndt_7~0; [L507] ~tmp_ndt_7~0 := #t~nondet33; [L507] havoc #t~nondet33; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L508] COND TRUE 1bv32 == ~tmp_ndt_7~0 VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L517] ~returnVal2~0 := 3221225473bv32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L527] COND FALSE !(~s~0 == ~NP~0) VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L531] COND FALSE !(~s~0 == ~MPR1~0) VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L540] COND TRUE ~s~0 == ~SKIP1~0 [L541] ~s~0 := ~SKIP2~0; [L542] ~lowerDriverReturn~0 := ~returnVal2~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L550] #res := ~returnVal2~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #res=3221225473bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L246] RET call #t~ret13 := IofCallDriver(~devExt__TopOfStack~0, ~Irp); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #t~ret13=3221225473bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L246] havoc #t~ret13; [L247] ~status~0 := 0bv32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L289] #res := ~status~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #res=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L387] RET call #t~ret27 := KbFilter_PnP(~devobj~0, ~pirp~0); VAL [#t~ret27=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L387] ~status~1 := #t~ret27; [L387] havoc #t~ret27; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L411] COND FALSE !(1bv32 == ~pended~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L419] COND FALSE !(1bv32 == ~pended~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L427] COND TRUE ~s~0 != ~UNLOADED~0 VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L428] COND TRUE 4294967295bv32 != ~status~1 VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L429] COND FALSE !(~s~0 != ~SKIP2~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L439] COND FALSE !(1bv32 == ~pended~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L446] COND FALSE !(~s~0 == ~DC~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L451] COND TRUE ~status~1 != ~lowerDriverReturn~0 VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L452] CALL call errorFn(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L1012] assert false; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [?] CALL call ULTIMATE.init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L22] ~KernelMode~0 := 0bv32; [L23] ~Executive~0 := 0bv32; [L24] ~DevicePowerState~0 := 0bv32; [L25] ~s~0 := 0bv32; [L26] ~UNLOADED~0 := 0bv32; [L27] ~NP~0 := 0bv32; [L28] ~DC~0 := 0bv32; [L29] ~SKIP1~0 := 0bv32; [L30] ~SKIP2~0 := 0bv32; [L31] ~MPR1~0 := 0bv32; [L32] ~MPR3~0 := 0bv32; [L33] ~IPC~0 := 0bv32; [L34] ~pended~0 := 0bv32; [L35] ~compFptr~0 := 0bv32; [L36] ~compRegistered~0 := 0bv32; [L37] ~lowerDriverReturn~0 := 0bv32; [L38] ~setEventCalled~0 := 0bv32; [L39] ~customIrp~0 := 0bv32; [L40] ~myStatus~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [?] RET call ULTIMATE.init(); VAL [~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [?] CALL call #t~ret77 := main(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L293] havoc ~status~1; [L294] ~irp~0 := #t~nondet17; [L294] havoc #t~nondet17; [L295] havoc ~pirp~0; [L296] havoc ~pirp__IoStatus__Status~0; [L297] ~irp_choice~0 := #t~nondet18; [L297] havoc #t~nondet18; [L298] ~devobj~0 := #t~nondet19; [L298] havoc #t~nondet19; [L299] havoc ~__cil_tmp8~0; [L301] ~KernelMode~0 := 0bv32; [L302] ~Executive~0 := 0bv32; [L303] ~DevicePowerState~0 := 1bv32; [L304] ~s~0 := 0bv32; [L305] ~UNLOADED~0 := 0bv32; [L306] ~NP~0 := 0bv32; [L307] ~DC~0 := 0bv32; [L308] ~SKIP1~0 := 0bv32; [L309] ~SKIP2~0 := 0bv32; [L310] ~MPR1~0 := 0bv32; [L311] ~MPR3~0 := 0bv32; [L312] ~IPC~0 := 0bv32; [L313] ~pended~0 := 0bv32; [L314] ~compFptr~0 := 0bv32; [L315] ~compRegistered~0 := 0bv32; [L316] ~lowerDriverReturn~0 := 0bv32; [L317] ~setEventCalled~0 := 0bv32; [L318] ~customIrp~0 := 0bv32; [L319] ~myStatus~0 := 0bv32; [L323] ~status~1 := 0bv32; [L324] ~pirp~0 := ~irp~0; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~status~1=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L325] CALL call _BLAST_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L60] ~UNLOADED~0 := 0bv32; [L61] ~NP~0 := 1bv32; [L62] ~DC~0 := 2bv32; [L63] ~SKIP1~0 := 3bv32; [L64] ~SKIP2~0 := 4bv32; [L65] ~MPR1~0 := 5bv32; [L66] ~MPR3~0 := 6bv32; [L67] ~IPC~0 := 7bv32; [L68] ~s~0 := ~UNLOADED~0; [L69] ~pended~0 := 0bv32; [L70] ~compFptr~0 := 0bv32; [L71] ~compRegistered~0 := 0bv32; [L72] ~lowerDriverReturn~0 := 0bv32; [L73] ~setEventCalled~0 := 0bv32; [L74] ~customIrp~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L325] RET call _BLAST_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L327] COND TRUE ~bvsge32(~status~1, 0bv32) [L328] ~s~0 := ~NP~0; [L329] ~customIrp~0 := 0bv32; [L330] ~setEventCalled~0 := ~customIrp~0; [L331] ~lowerDriverReturn~0 := ~setEventCalled~0; [L332] ~compRegistered~0 := ~lowerDriverReturn~0; [L333] ~pended~0 := ~compRegistered~0; [L334] ~pirp__IoStatus__Status~0 := 0bv32; [L335] ~myStatus~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L336] COND FALSE !(0bv32 == ~irp_choice~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L341] CALL call stub_driver_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L46] ~s~0 := ~NP~0; [L47] ~pended~0 := 0bv32; [L48] ~compFptr~0 := 0bv32; [L49] ~compRegistered~0 := 0bv32; [L50] ~lowerDriverReturn~0 := 0bv32; [L51] ~setEventCalled~0 := 0bv32; [L52] ~customIrp~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L341] RET call stub_driver_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L344] COND FALSE !(~bvslt32(~status~1, 0bv32)) [L348] havoc ~tmp_ndt_1~0; [L349] ~tmp_ndt_1~0 := #t~nondet20; [L349] havoc #t~nondet20; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~UNLOADED~0=0bv32] [L350] COND FALSE !(0bv32 == ~tmp_ndt_1~0) [L353] havoc ~tmp_ndt_2~0; [L354] ~tmp_ndt_2~0 := #t~nondet21; [L354] havoc #t~nondet21; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~UNLOADED~0=0bv32] [L355] COND FALSE !(1bv32 == ~tmp_ndt_2~0) [L358] havoc ~tmp_ndt_3~0; [L359] ~tmp_ndt_3~0 := #t~nondet22; [L359] havoc #t~nondet22; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L360] COND TRUE 3bv32 == ~tmp_ndt_3~0 VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L387] CALL call #t~ret27 := KbFilter_PnP(~devobj~0, ~pirp~0); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L78-L291] ~DeviceObject := #in~DeviceObject; [L78-L291] ~Irp := #in~Irp; [L79] havoc ~devExt~0; [L80] havoc ~irpStack~0; [L81] havoc ~status~0; [L82] ~event~0 := #t~nondet0; [L82] havoc #t~nondet0; [L83] ~DeviceObject__DeviceExtension~0 := #t~nondet1; [L83] havoc #t~nondet1; [L84] ~Irp__Tail__Overlay__CurrentStackLocation~0 := #t~nondet2; [L84] havoc #t~nondet2; [L85] ~irpStack__MinorFunction~0 := #t~nondet3; [L85] havoc #t~nondet3; [L86] ~devExt__TopOfStack~0 := #t~nondet4; [L86] havoc #t~nondet4; [L87] havoc ~devExt__Started~0; [L88] havoc ~devExt__Removed~0; [L89] havoc ~devExt__SurpriseRemoved~0; [L90] havoc ~Irp__IoStatus__Status~0; [L91] havoc ~Irp__IoStatus__Information~0; [L92] ~Irp__CurrentLocation~0 := #t~nondet5; [L92] havoc #t~nondet5; [L93] havoc ~irpSp~0; [L94] havoc ~nextIrpSp~0; [L95] havoc ~nextIrpSp__Control~0; [L96] havoc ~irpSp___0~0; [L97] havoc ~irpSp__Context~0; [L98] havoc ~irpSp__Control~0; [L99] havoc ~__cil_tmp23~0; [L102] ~status~0 := 0bv32; [L103] ~devExt~0 := ~DeviceObject__DeviceExtension~0; [L104] ~irpStack~0 := ~Irp__Tail__Overlay__CurrentStackLocation~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L105] COND FALSE !(0bv32 == ~irpStack__MinorFunction~0) VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L108] COND FALSE !(23bv32 == ~irpStack__MinorFunction~0) VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L111] COND TRUE 2bv32 == ~irpStack__MinorFunction~0 VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L235] ~devExt__Removed~0 := 1bv32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L236] COND TRUE ~s~0 == ~NP~0 [L237] ~s~0 := ~SKIP1~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L244] #t~post11 := ~Irp__CurrentLocation~0; [L244] ~Irp__CurrentLocation~0 := ~bvadd32(1bv32, #t~post11); [L244] havoc #t~post11; [L245] #t~post12 := ~Irp__Tail__Overlay__CurrentStackLocation~0; [L245] ~Irp__Tail__Overlay__CurrentStackLocation~0 := ~bvadd32(1bv32, #t~post12); [L245] havoc #t~post12; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L246] CALL call #t~ret13 := IofCallDriver(~devExt__TopOfStack~0, ~Irp); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L480-L552] ~DeviceObject := #in~DeviceObject; [L480-L552] ~Irp := #in~Irp; [L482] havoc ~returnVal2~0; [L483] havoc ~compRetStatus~0; [L484] ~lcontext~0 := #t~nondet30; [L484] havoc #t~nondet30; [L485] havoc ~__cil_tmp7~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L488-L500] COND FALSE !(0bv32 != ~compRegistered~0) VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L501] havoc ~tmp_ndt_6~0; [L502] ~tmp_ndt_6~0 := #t~nondet32; [L502] havoc #t~nondet32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~UNLOADED~0=0bv32] [L503] COND FALSE !(0bv32 == ~tmp_ndt_6~0) [L506] havoc ~tmp_ndt_7~0; [L507] ~tmp_ndt_7~0 := #t~nondet33; [L507] havoc #t~nondet33; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L508] COND TRUE 1bv32 == ~tmp_ndt_7~0 VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L517] ~returnVal2~0 := 3221225473bv32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L527] COND FALSE !(~s~0 == ~NP~0) VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L531] COND FALSE !(~s~0 == ~MPR1~0) VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L540] COND TRUE ~s~0 == ~SKIP1~0 [L541] ~s~0 := ~SKIP2~0; [L542] ~lowerDriverReturn~0 := ~returnVal2~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L550] #res := ~returnVal2~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #res=3221225473bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L246] RET call #t~ret13 := IofCallDriver(~devExt__TopOfStack~0, ~Irp); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #t~ret13=3221225473bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L246] havoc #t~ret13; [L247] ~status~0 := 0bv32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L289] #res := ~status~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #res=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L387] RET call #t~ret27 := KbFilter_PnP(~devobj~0, ~pirp~0); VAL [#t~ret27=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L387] ~status~1 := #t~ret27; [L387] havoc #t~ret27; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L411] COND FALSE !(1bv32 == ~pended~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L419] COND FALSE !(1bv32 == ~pended~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L427] COND TRUE ~s~0 != ~UNLOADED~0 VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L428] COND TRUE 4294967295bv32 != ~status~1 VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L429] COND FALSE !(~s~0 != ~SKIP2~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L439] COND FALSE !(1bv32 == ~pended~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L446] COND FALSE !(~s~0 == ~DC~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L451] COND TRUE ~status~1 != ~lowerDriverReturn~0 VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L452] CALL call errorFn(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L1012] assert false; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] ----- ----- class de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator.CACSL2BoogieBacktranslator [?] CALL call ULTIMATE.init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L22] ~KernelMode~0 := 0bv32; [L23] ~Executive~0 := 0bv32; [L24] ~DevicePowerState~0 := 0bv32; [L25] ~s~0 := 0bv32; [L26] ~UNLOADED~0 := 0bv32; [L27] ~NP~0 := 0bv32; [L28] ~DC~0 := 0bv32; [L29] ~SKIP1~0 := 0bv32; [L30] ~SKIP2~0 := 0bv32; [L31] ~MPR1~0 := 0bv32; [L32] ~MPR3~0 := 0bv32; [L33] ~IPC~0 := 0bv32; [L34] ~pended~0 := 0bv32; [L35] ~compFptr~0 := 0bv32; [L36] ~compRegistered~0 := 0bv32; [L37] ~lowerDriverReturn~0 := 0bv32; [L38] ~setEventCalled~0 := 0bv32; [L39] ~customIrp~0 := 0bv32; [L40] ~myStatus~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [?] RET call ULTIMATE.init(); VAL [~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [?] CALL call #t~ret77 := main(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L293] havoc ~status~1; [L294] ~irp~0 := #t~nondet17; [L294] havoc #t~nondet17; [L295] havoc ~pirp~0; [L296] havoc ~pirp__IoStatus__Status~0; [L297] ~irp_choice~0 := #t~nondet18; [L297] havoc #t~nondet18; [L298] ~devobj~0 := #t~nondet19; [L298] havoc #t~nondet19; [L299] havoc ~__cil_tmp8~0; [L301] ~KernelMode~0 := 0bv32; [L302] ~Executive~0 := 0bv32; [L303] ~DevicePowerState~0 := 1bv32; [L304] ~s~0 := 0bv32; [L305] ~UNLOADED~0 := 0bv32; [L306] ~NP~0 := 0bv32; [L307] ~DC~0 := 0bv32; [L308] ~SKIP1~0 := 0bv32; [L309] ~SKIP2~0 := 0bv32; [L310] ~MPR1~0 := 0bv32; [L311] ~MPR3~0 := 0bv32; [L312] ~IPC~0 := 0bv32; [L313] ~pended~0 := 0bv32; [L314] ~compFptr~0 := 0bv32; [L315] ~compRegistered~0 := 0bv32; [L316] ~lowerDriverReturn~0 := 0bv32; [L317] ~setEventCalled~0 := 0bv32; [L318] ~customIrp~0 := 0bv32; [L319] ~myStatus~0 := 0bv32; [L323] ~status~1 := 0bv32; [L324] ~pirp~0 := ~irp~0; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~status~1=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L325] CALL call _BLAST_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=0bv32, ~MPR3~0=0bv32, ~myStatus~0=0bv32, ~NP~0=0bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=0bv32, ~SKIP2~0=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L60] ~UNLOADED~0 := 0bv32; [L61] ~NP~0 := 1bv32; [L62] ~DC~0 := 2bv32; [L63] ~SKIP1~0 := 3bv32; [L64] ~SKIP2~0 := 4bv32; [L65] ~MPR1~0 := 5bv32; [L66] ~MPR3~0 := 6bv32; [L67] ~IPC~0 := 7bv32; [L68] ~s~0 := ~UNLOADED~0; [L69] ~pended~0 := 0bv32; [L70] ~compFptr~0 := 0bv32; [L71] ~compRegistered~0 := 0bv32; [L72] ~lowerDriverReturn~0 := 0bv32; [L73] ~setEventCalled~0 := 0bv32; [L74] ~customIrp~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L325] RET call _BLAST_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=0bv32, ~UNLOADED~0=0bv32] [L327] COND TRUE ~bvsge32(~status~1, 0bv32) [L328] ~s~0 := ~NP~0; [L329] ~customIrp~0 := 0bv32; [L330] ~setEventCalled~0 := ~customIrp~0; [L331] ~lowerDriverReturn~0 := ~setEventCalled~0; [L332] ~compRegistered~0 := ~lowerDriverReturn~0; [L333] ~pended~0 := ~compRegistered~0; [L334] ~pirp__IoStatus__Status~0 := 0bv32; [L335] ~myStatus~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L336] COND FALSE !(0bv32 == ~irp_choice~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L341] CALL call stub_driver_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L46] ~s~0 := ~NP~0; [L47] ~pended~0 := 0bv32; [L48] ~compFptr~0 := 0bv32; [L49] ~compRegistered~0 := 0bv32; [L50] ~lowerDriverReturn~0 := 0bv32; [L51] ~setEventCalled~0 := 0bv32; [L52] ~customIrp~0 := 0bv32; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L341] RET call stub_driver_init(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L344] COND FALSE !(~bvslt32(~status~1, 0bv32)) [L348] havoc ~tmp_ndt_1~0; [L349] ~tmp_ndt_1~0 := #t~nondet20; [L349] havoc #t~nondet20; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~UNLOADED~0=0bv32] [L350] COND FALSE !(0bv32 == ~tmp_ndt_1~0) [L353] havoc ~tmp_ndt_2~0; [L354] ~tmp_ndt_2~0 := #t~nondet21; [L354] havoc #t~nondet21; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~UNLOADED~0=0bv32] [L355] COND FALSE !(1bv32 == ~tmp_ndt_2~0) [L358] havoc ~tmp_ndt_3~0; [L359] ~tmp_ndt_3~0 := #t~nondet22; [L359] havoc #t~nondet22; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L360] COND TRUE 3bv32 == ~tmp_ndt_3~0 VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=1bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L387] CALL call #t~ret27 := KbFilter_PnP(~devobj~0, ~pirp~0); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L78-L291] ~DeviceObject := #in~DeviceObject; [L78-L291] ~Irp := #in~Irp; [L79] havoc ~devExt~0; [L80] havoc ~irpStack~0; [L81] havoc ~status~0; [L82] ~event~0 := #t~nondet0; [L82] havoc #t~nondet0; [L83] ~DeviceObject__DeviceExtension~0 := #t~nondet1; [L83] havoc #t~nondet1; [L84] ~Irp__Tail__Overlay__CurrentStackLocation~0 := #t~nondet2; [L84] havoc #t~nondet2; [L85] ~irpStack__MinorFunction~0 := #t~nondet3; [L85] havoc #t~nondet3; [L86] ~devExt__TopOfStack~0 := #t~nondet4; [L86] havoc #t~nondet4; [L87] havoc ~devExt__Started~0; [L88] havoc ~devExt__Removed~0; [L89] havoc ~devExt__SurpriseRemoved~0; [L90] havoc ~Irp__IoStatus__Status~0; [L91] havoc ~Irp__IoStatus__Information~0; [L92] ~Irp__CurrentLocation~0 := #t~nondet5; [L92] havoc #t~nondet5; [L93] havoc ~irpSp~0; [L94] havoc ~nextIrpSp~0; [L95] havoc ~nextIrpSp__Control~0; [L96] havoc ~irpSp___0~0; [L97] havoc ~irpSp__Context~0; [L98] havoc ~irpSp__Control~0; [L99] havoc ~__cil_tmp23~0; [L102] ~status~0 := 0bv32; [L103] ~devExt~0 := ~DeviceObject__DeviceExtension~0; [L104] ~irpStack~0 := ~Irp__Tail__Overlay__CurrentStackLocation~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L105] COND FALSE !(0bv32 == ~irpStack__MinorFunction~0) VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L108] COND FALSE !(23bv32 == ~irpStack__MinorFunction~0) VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L111] COND TRUE 2bv32 == ~irpStack__MinorFunction~0 VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L235] ~devExt__Removed~0 := 1bv32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=1bv32, ~UNLOADED~0=0bv32] [L236] COND TRUE ~s~0 == ~NP~0 [L237] ~s~0 := ~SKIP1~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483647bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483647bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L244] #t~post11 := ~Irp__CurrentLocation~0; [L244] ~Irp__CurrentLocation~0 := ~bvadd32(1bv32, #t~post11); [L244] havoc #t~post11; [L245] #t~post12 := ~Irp__Tail__Overlay__CurrentStackLocation~0; [L245] ~Irp__Tail__Overlay__CurrentStackLocation~0 := ~bvadd32(1bv32, #t~post12); [L245] havoc #t~post12; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L246] CALL call #t~ret13 := IofCallDriver(~devExt__TopOfStack~0, ~Irp); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L480-L552] ~DeviceObject := #in~DeviceObject; [L480-L552] ~Irp := #in~Irp; [L482] havoc ~returnVal2~0; [L483] havoc ~compRetStatus~0; [L484] ~lcontext~0 := #t~nondet30; [L484] havoc #t~nondet30; [L485] havoc ~__cil_tmp7~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L488-L500] COND FALSE !(0bv32 != ~compRegistered~0) VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~UNLOADED~0=0bv32] [L501] havoc ~tmp_ndt_6~0; [L502] ~tmp_ndt_6~0 := #t~nondet32; [L502] havoc #t~nondet32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~UNLOADED~0=0bv32] [L503] COND FALSE !(0bv32 == ~tmp_ndt_6~0) [L506] havoc ~tmp_ndt_7~0; [L507] ~tmp_ndt_7~0 := #t~nondet33; [L507] havoc #t~nondet33; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L508] COND TRUE 1bv32 == ~tmp_ndt_7~0 VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L517] ~returnVal2~0 := 3221225473bv32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L527] COND FALSE !(~s~0 == ~NP~0) VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L531] COND FALSE !(~s~0 == ~MPR1~0) VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=0bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=3bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L540] COND TRUE ~s~0 == ~SKIP1~0 [L541] ~s~0 := ~SKIP2~0; [L542] ~lowerDriverReturn~0 := ~returnVal2~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L550] #res := ~returnVal2~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #res=3221225473bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=3bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DeviceObject=0bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~KernelMode~0=0bv32, ~lcontext~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~returnVal2~0=3221225473bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~tmp_ndt_6~0=1bv32, ~tmp_ndt_7~0=1bv32, ~UNLOADED~0=0bv32] [L246] RET call #t~ret13 := IofCallDriver(~devExt__TopOfStack~0, ~Irp); VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #t~ret13=3221225473bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L246] havoc #t~ret13; [L247] ~status~0 := 0bv32; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L289] #res := ~status~0; VAL [#in~DeviceObject=0bv32, #in~Irp=0bv32, #res=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=1bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~devExt__Removed~0=1bv32, ~devExt__TopOfStack~0=0bv32, ~devExt~0=0bv32, ~DeviceObject=0bv32, ~DeviceObject__DeviceExtension~0=0bv32, ~DevicePowerState~0=1bv32, ~event~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~Irp=0bv32, ~Irp__CurrentLocation~0=2147483648bv32, ~Irp__Tail__Overlay__CurrentStackLocation~0=2147483648bv32, ~irpStack__MinorFunction~0=2bv32, ~irpStack~0=2147483647bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~0=0bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L387] RET call #t~ret27 := KbFilter_PnP(~devobj~0, ~pirp~0); VAL [#t~ret27=0bv32, old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L387] ~status~1 := #t~ret27; [L387] havoc #t~ret27; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L411] COND FALSE !(1bv32 == ~pended~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L419] COND FALSE !(1bv32 == ~pended~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L427] COND TRUE ~s~0 != ~UNLOADED~0 VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L428] COND TRUE 4294967295bv32 != ~status~1 VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L429] COND FALSE !(~s~0 != ~SKIP2~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L439] COND FALSE !(1bv32 == ~pended~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L446] COND FALSE !(~s~0 == ~DC~0) VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L451] COND TRUE ~status~1 != ~lowerDriverReturn~0 VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~devobj~0=0bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~irp_choice~0=1bv32, ~irp~0=0bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~pirp__IoStatus__Status~0=0bv32, ~pirp~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~status~1=0bv32, ~s~0=4bv32, ~tmp_ndt_1~0=1bv32, ~tmp_ndt_2~0=0bv32, ~tmp_ndt_3~0=3bv32, ~UNLOADED~0=0bv32] [L452] CALL call errorFn(); VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L1012] assert false; VAL [old(~compFptr~0)=0bv32, old(~compRegistered~0)=0bv32, old(~customIrp~0)=0bv32, old(~DC~0)=0bv32, old(~DevicePowerState~0)=0bv32, old(~Executive~0)=0bv32, old(~IPC~0)=0bv32, old(~KernelMode~0)=0bv32, old(~lowerDriverReturn~0)=0bv32, old(~MPR1~0)=0bv32, old(~MPR3~0)=0bv32, old(~myStatus~0)=0bv32, old(~NP~0)=0bv32, old(~pended~0)=0bv32, old(~setEventCalled~0)=0bv32, old(~SKIP1~0)=0bv32, old(~SKIP2~0)=0bv32, old(~s~0)=0bv32, old(~UNLOADED~0)=0bv32, ~compFptr~0=0bv32, ~compRegistered~0=0bv32, ~customIrp~0=0bv32, ~DC~0=2bv32, ~DevicePowerState~0=1bv32, ~Executive~0=0bv32, ~IPC~0=7bv32, ~KernelMode~0=0bv32, ~lowerDriverReturn~0=3221225473bv32, ~MPR1~0=5bv32, ~MPR3~0=6bv32, ~myStatus~0=0bv32, ~NP~0=1bv32, ~pended~0=0bv32, ~setEventCalled~0=0bv32, ~SKIP1~0=3bv32, ~SKIP2~0=4bv32, ~s~0=4bv32, ~UNLOADED~0=0bv32] [L22] int KernelMode ; [L23] int Executive ; [L24] int DevicePowerState ; [L25] int s ; [L26] int UNLOADED ; [L27] int NP ; [L28] int DC ; [L29] int SKIP1 ; [L30] int SKIP2 ; [L31] int MPR1 ; [L32] int MPR3 ; [L33] int IPC ; [L34] int pended ; [L35] int compFptr ; [L36] int compRegistered ; [L37] int lowerDriverReturn ; [L38] int setEventCalled ; [L39] int customIrp ; [L40] int myStatus ; VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=0, DevicePowerState=0, Executive=0, IPC=0, KernelMode=0, lowerDriverReturn=0, MPR1=0, MPR3=0, myStatus=0, NP=0, pended=0, s=0, setEventCalled=0, SKIP1=0, SKIP2=0, UNLOADED=0] [L293] int status ; [L294] int irp = __VERIFIER_nondet_int() ; [L295] int pirp ; [L296] int pirp__IoStatus__Status ; [L297] int irp_choice = __VERIFIER_nondet_int() ; [L298] int devobj = __VERIFIER_nondet_int() ; [L299] int __cil_tmp8 ; [L301] KernelMode = 0 [L302] Executive = 0 [L303] DevicePowerState = 1 [L304] s = 0 [L305] UNLOADED = 0 [L306] NP = 0 [L307] DC = 0 [L308] SKIP1 = 0 [L309] SKIP2 = 0 [L310] MPR1 = 0 [L311] MPR3 = 0 [L312] IPC = 0 [L313] pended = 0 [L314] compFptr = 0 [L315] compRegistered = 0 [L316] lowerDriverReturn = 0 [L317] setEventCalled = 0 [L318] customIrp = 0 [L319] myStatus = 0 [L323] status = 0 [L324] pirp = irp VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=0, DevicePowerState=1, devobj=0, Executive=0, IPC=0, irp=0, irp_choice=1, KernelMode=0, lowerDriverReturn=0, MPR1=0, MPR3=0, myStatus=0, NP=0, pended=0, pirp=0, s=0, setEventCalled=0, SKIP1=0, SKIP2=0, status=0, UNLOADED=0] [L325] CALL _BLAST_init() VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=0, DevicePowerState=1, Executive=0, IPC=0, KernelMode=0, lowerDriverReturn=0, MPR1=0, MPR3=0, myStatus=0, NP=0, pended=0, s=0, setEventCalled=0, SKIP1=0, SKIP2=0, UNLOADED=0] [L60] UNLOADED = 0 [L61] NP = 1 [L62] DC = 2 [L63] SKIP1 = 3 [L64] SKIP2 = 4 [L65] MPR1 = 5 [L66] MPR3 = 6 [L67] IPC = 7 [L68] s = UNLOADED [L69] pended = 0 [L70] compFptr = 0 [L71] compRegistered = 0 [L72] lowerDriverReturn = 0 [L73] setEventCalled = 0 [L74] customIrp = 0 VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, Executive=0, IPC=7, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=0, setEventCalled=0, SKIP1=3, SKIP2=4, UNLOADED=0] [L325] RET _BLAST_init() VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, devobj=0, Executive=0, IPC=7, irp=0, irp_choice=1, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, pirp=0, s=0, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, UNLOADED=0] [L327] COND TRUE status >= 0 [L328] s = NP [L329] customIrp = 0 [L330] setEventCalled = customIrp [L331] lowerDriverReturn = setEventCalled [L332] compRegistered = lowerDriverReturn [L333] pended = compRegistered [L334] pirp__IoStatus__Status = 0 [L335] myStatus = 0 VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, devobj=0, Executive=0, IPC=7, irp=0, irp_choice=1, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, pirp=0, pirp__IoStatus__Status=0, s=1, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, UNLOADED=0] [L336] COND FALSE !(irp_choice == 0) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, devobj=0, Executive=0, IPC=7, irp=0, irp_choice=1, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, pirp=0, pirp__IoStatus__Status=0, s=1, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, UNLOADED=0] [L341] CALL stub_driver_init() VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=1, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, Executive=0, IPC=7, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=1, setEventCalled=0, SKIP1=3, SKIP2=4, UNLOADED=0] [L46] s = NP [L47] pended = 0 [L48] compFptr = 0 [L49] compRegistered = 0 [L50] lowerDriverReturn = 0 [L51] setEventCalled = 0 [L52] customIrp = 0 VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=1, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, Executive=0, IPC=7, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=1, setEventCalled=0, SKIP1=3, SKIP2=4, UNLOADED=0] [L341] RET stub_driver_init() VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, devobj=0, Executive=0, IPC=7, irp=0, irp_choice=1, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, pirp=0, pirp__IoStatus__Status=0, s=1, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, UNLOADED=0] [L344] COND FALSE !(status < 0) [L348] int tmp_ndt_1; [L349] tmp_ndt_1 = __VERIFIER_nondet_int() [L350] COND FALSE !(tmp_ndt_1 == 0) [L353] int tmp_ndt_2; [L354] tmp_ndt_2 = __VERIFIER_nondet_int() [L355] COND FALSE !(tmp_ndt_2 == 1) [L358] int tmp_ndt_3; [L359] tmp_ndt_3 = __VERIFIER_nondet_int() [L360] COND TRUE tmp_ndt_3 == 3 VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, devobj=0, Executive=0, IPC=7, irp=0, irp_choice=1, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, pirp=0, pirp__IoStatus__Status=0, s=1, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, tmp_ndt_1=1, tmp_ndt_2=0, tmp_ndt_3=3, UNLOADED=0] [L387] CALL, EXPR KbFilter_PnP(devobj, pirp) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=1, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, Executive=0, IPC=7, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=1, setEventCalled=0, SKIP1=3, SKIP2=4, UNLOADED=0] [L79] int devExt ; [L80] int irpStack ; [L81] int status ; [L82] int event = __VERIFIER_nondet_int() ; [L83] int DeviceObject__DeviceExtension = __VERIFIER_nondet_int() ; [L84] int Irp__Tail__Overlay__CurrentStackLocation = __VERIFIER_nondet_int() ; [L85] int irpStack__MinorFunction = __VERIFIER_nondet_int() ; [L86] int devExt__TopOfStack = __VERIFIER_nondet_int() ; [L87] int devExt__Started ; [L88] int devExt__Removed ; [L89] int devExt__SurpriseRemoved ; [L90] int Irp__IoStatus__Status ; [L91] int Irp__IoStatus__Information ; [L92] int Irp__CurrentLocation = __VERIFIER_nondet_int() ; [L93] int irpSp ; [L94] int nextIrpSp ; [L95] int nextIrpSp__Control ; [L96] int irpSp___0 ; [L97] int irpSp__Context ; [L98] int irpSp__Control ; [L99] long __cil_tmp23 ; [L102] status = 0 [L103] devExt = DeviceObject__DeviceExtension [L104] irpStack = Irp__Tail__Overlay__CurrentStackLocation VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=1, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, devExt=0, devExt__TopOfStack=0, DeviceObject=0, DeviceObject__DeviceExtension=0, DevicePowerState=1, event=0, Executive=0, IPC=7, Irp=0, Irp__CurrentLocation=2147483647, Irp__Tail__Overlay__CurrentStackLocation=2147483647, irpStack=2147483647, irpStack__MinorFunction=2, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=1, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, UNLOADED=0] [L105] COND FALSE !(irpStack__MinorFunction == 0) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=1, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, devExt=0, devExt__TopOfStack=0, DeviceObject=0, DeviceObject__DeviceExtension=0, DevicePowerState=1, event=0, Executive=0, IPC=7, Irp=0, Irp__CurrentLocation=2147483647, Irp__Tail__Overlay__CurrentStackLocation=2147483647, irpStack=2147483647, irpStack__MinorFunction=2, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=1, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, UNLOADED=0] [L108] COND FALSE !(irpStack__MinorFunction == 23) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=1, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, devExt=0, devExt__TopOfStack=0, DeviceObject=0, DeviceObject__DeviceExtension=0, DevicePowerState=1, event=0, Executive=0, IPC=7, Irp=0, Irp__CurrentLocation=2147483647, Irp__Tail__Overlay__CurrentStackLocation=2147483647, irpStack=2147483647, irpStack__MinorFunction=2, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=1, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, UNLOADED=0] [L111] COND TRUE irpStack__MinorFunction == 2 VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=1, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, devExt=0, devExt__TopOfStack=0, DeviceObject=0, DeviceObject__DeviceExtension=0, DevicePowerState=1, event=0, Executive=0, IPC=7, Irp=0, Irp__CurrentLocation=2147483647, Irp__Tail__Overlay__CurrentStackLocation=2147483647, irpStack=2147483647, irpStack__MinorFunction=2, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=1, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, UNLOADED=0] [L235] devExt__Removed = 1 VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=1, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, devExt=0, devExt__Removed=1, devExt__TopOfStack=0, DeviceObject=0, DeviceObject__DeviceExtension=0, DevicePowerState=1, event=0, Executive=0, IPC=7, Irp=0, Irp__CurrentLocation=2147483647, Irp__Tail__Overlay__CurrentStackLocation=2147483647, irpStack=2147483647, irpStack__MinorFunction=2, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=1, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, UNLOADED=0] [L236] COND TRUE s == NP [L237] s = SKIP1 VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=1, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, devExt=0, devExt__Removed=1, devExt__TopOfStack=0, DeviceObject=0, DeviceObject__DeviceExtension=0, DevicePowerState=1, event=0, Executive=0, IPC=7, Irp=0, Irp__CurrentLocation=2147483647, Irp__Tail__Overlay__CurrentStackLocation=2147483647, irpStack=2147483647, irpStack__MinorFunction=2, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=3, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, UNLOADED=0] [L244] Irp__CurrentLocation ++ [L245] Irp__Tail__Overlay__CurrentStackLocation ++ VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=1, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, devExt=0, devExt__Removed=1, devExt__TopOfStack=0, DeviceObject=0, DeviceObject__DeviceExtension=0, DevicePowerState=1, event=0, Executive=0, IPC=7, Irp=0, Irp__CurrentLocation=2147483648, Irp__Tail__Overlay__CurrentStackLocation=2147483648, irpStack=2147483647, irpStack__MinorFunction=2, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=3, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, UNLOADED=0] [L246] CALL IofCallDriver(devExt__TopOfStack, Irp) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=3, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, Executive=0, IPC=7, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=3, setEventCalled=0, SKIP1=3, SKIP2=4, UNLOADED=0] [L482] int returnVal2 ; [L483] int compRetStatus ; [L484] int lcontext = __VERIFIER_nondet_int() ; [L485] long long __cil_tmp7 ; VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=3, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DeviceObject=0, DevicePowerState=1, Executive=0, IPC=7, Irp=0, KernelMode=0, lcontext=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=3, setEventCalled=0, SKIP1=3, SKIP2=4, UNLOADED=0] [L488] COND FALSE !(\read(compRegistered)) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=3, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DeviceObject=0, DevicePowerState=1, Executive=0, IPC=7, Irp=0, KernelMode=0, lcontext=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=3, setEventCalled=0, SKIP1=3, SKIP2=4, UNLOADED=0] [L501] int tmp_ndt_6; [L502] tmp_ndt_6 = __VERIFIER_nondet_int() [L503] COND FALSE !(tmp_ndt_6 == 0) [L506] int tmp_ndt_7; [L507] tmp_ndt_7 = __VERIFIER_nondet_int() [L508] COND TRUE tmp_ndt_7 == 1 VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=3, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DeviceObject=0, DevicePowerState=1, Executive=0, IPC=7, Irp=0, KernelMode=0, lcontext=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=3, setEventCalled=0, SKIP1=3, SKIP2=4, tmp_ndt_6=1, tmp_ndt_7=1, UNLOADED=0] [L517] returnVal2 = -1073741823 VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=3, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DeviceObject=0, DevicePowerState=1, Executive=0, IPC=7, Irp=0, KernelMode=0, lcontext=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, returnVal2=3221225473, s=3, setEventCalled=0, SKIP1=3, SKIP2=4, tmp_ndt_6=1, tmp_ndt_7=1, UNLOADED=0] [L527] COND FALSE !(s == NP) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=3, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DeviceObject=0, DevicePowerState=1, Executive=0, IPC=7, Irp=0, KernelMode=0, lcontext=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, returnVal2=3221225473, s=3, setEventCalled=0, SKIP1=3, SKIP2=4, tmp_ndt_6=1, tmp_ndt_7=1, UNLOADED=0] [L531] COND FALSE !(s == MPR1) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=3, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DeviceObject=0, DevicePowerState=1, Executive=0, IPC=7, Irp=0, KernelMode=0, lcontext=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, returnVal2=3221225473, s=3, setEventCalled=0, SKIP1=3, SKIP2=4, tmp_ndt_6=1, tmp_ndt_7=1, UNLOADED=0] [L540] COND TRUE s == SKIP1 [L541] s = SKIP2 [L542] lowerDriverReturn = returnVal2 VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=3, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DeviceObject=0, DevicePowerState=1, Executive=0, IPC=7, Irp=0, KernelMode=0, lcontext=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, returnVal2=3221225473, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, tmp_ndt_6=1, tmp_ndt_7=1, UNLOADED=0] [L550] return (returnVal2); VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=3, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, \result=-1073741823, compFptr=0, compRegistered=0, customIrp=0, DC=2, DeviceObject=0, DevicePowerState=1, Executive=0, IPC=7, Irp=0, KernelMode=0, lcontext=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, returnVal2=3221225473, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, tmp_ndt_6=1, tmp_ndt_7=1, UNLOADED=0] [L246] RET IofCallDriver(devExt__TopOfStack, Irp) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=1, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, devExt=0, devExt__Removed=1, devExt__TopOfStack=0, DeviceObject=0, DeviceObject__DeviceExtension=0, DevicePowerState=1, event=0, Executive=0, IofCallDriver(devExt__TopOfStack, Irp)=-1073741823, IPC=7, Irp=0, Irp__CurrentLocation=2147483648, Irp__Tail__Overlay__CurrentStackLocation=2147483648, irpStack=2147483647, irpStack__MinorFunction=2, KernelMode=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, UNLOADED=0] [L247] status = 0 VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=1, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, devExt=0, devExt__Removed=1, devExt__TopOfStack=0, DeviceObject=0, DeviceObject__DeviceExtension=0, DevicePowerState=1, event=0, Executive=0, IPC=7, Irp=0, Irp__CurrentLocation=2147483648, Irp__Tail__Overlay__CurrentStackLocation=2147483648, irpStack=2147483647, irpStack__MinorFunction=2, KernelMode=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, UNLOADED=0] [L289] return (status); VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=1, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, \result=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, devExt=0, devExt__Removed=1, devExt__TopOfStack=0, DeviceObject=0, DeviceObject__DeviceExtension=0, DevicePowerState=1, event=0, Executive=0, IPC=7, Irp=0, Irp__CurrentLocation=2147483648, Irp__Tail__Overlay__CurrentStackLocation=2147483648, irpStack=2147483647, irpStack__MinorFunction=2, KernelMode=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, UNLOADED=0] [L387] RET, EXPR KbFilter_PnP(devobj, pirp) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, devobj=0, Executive=0, IPC=7, irp=0, irp_choice=1, KbFilter_PnP(devobj, pirp)=0, KernelMode=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, pirp=0, pirp__IoStatus__Status=0, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, tmp_ndt_1=1, tmp_ndt_2=0, tmp_ndt_3=3, UNLOADED=0] [L387] status = KbFilter_PnP(devobj, pirp) [L411] COND FALSE !(pended == 1) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, devobj=0, Executive=0, IPC=7, irp=0, irp_choice=1, KernelMode=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, pirp=0, pirp__IoStatus__Status=0, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, tmp_ndt_1=1, tmp_ndt_2=0, tmp_ndt_3=3, UNLOADED=0] [L419] COND FALSE !(pended == 1) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, devobj=0, Executive=0, IPC=7, irp=0, irp_choice=1, KernelMode=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, pirp=0, pirp__IoStatus__Status=0, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, tmp_ndt_1=1, tmp_ndt_2=0, tmp_ndt_3=3, UNLOADED=0] [L427] COND TRUE s != UNLOADED VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, devobj=0, Executive=0, IPC=7, irp=0, irp_choice=1, KernelMode=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, pirp=0, pirp__IoStatus__Status=0, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, tmp_ndt_1=1, tmp_ndt_2=0, tmp_ndt_3=3, UNLOADED=0] [L428] COND TRUE status != -1 VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, devobj=0, Executive=0, IPC=7, irp=0, irp_choice=1, KernelMode=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, pirp=0, pirp__IoStatus__Status=0, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, tmp_ndt_1=1, tmp_ndt_2=0, tmp_ndt_3=3, UNLOADED=0] [L429] COND FALSE !(s != SKIP2) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, devobj=0, Executive=0, IPC=7, irp=0, irp_choice=1, KernelMode=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, pirp=0, pirp__IoStatus__Status=0, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, tmp_ndt_1=1, tmp_ndt_2=0, tmp_ndt_3=3, UNLOADED=0] [L439] COND FALSE !(pended == 1) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, devobj=0, Executive=0, IPC=7, irp=0, irp_choice=1, KernelMode=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, pirp=0, pirp__IoStatus__Status=0, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, tmp_ndt_1=1, tmp_ndt_2=0, tmp_ndt_3=3, UNLOADED=0] [L446] COND FALSE !(s == DC) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, devobj=0, Executive=0, IPC=7, irp=0, irp_choice=1, KernelMode=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, pirp=0, pirp__IoStatus__Status=0, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, tmp_ndt_1=1, tmp_ndt_2=0, tmp_ndt_3=3, UNLOADED=0] [L451] COND TRUE status != lowerDriverReturn VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, devobj=0, Executive=0, IPC=7, irp=0, irp_choice=1, KernelMode=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, pirp=0, pirp__IoStatus__Status=0, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, tmp_ndt_1=1, tmp_ndt_2=0, tmp_ndt_3=3, UNLOADED=0] [L452] CALL errorFn() VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, Executive=0, IPC=7, KernelMode=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, UNLOADED=0] [L1012] __VERIFIER_error() VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, Executive=0, IPC=7, KernelMode=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, UNLOADED=0] ----- [2018-11-23 10:49:44,028 INFO L145 WitnessManager]: Wrote witness to /storage/repos/svcomp/c/ntdrivers-simplified/kbfiltr_simpl2_false-unreach-call_true-valid-memsafety_true-termination.cil.c-witness.graphml [2018-11-23 10:49:44,028 INFO L132 PluginConnector]: ------------------------ END Witness Printer---------------------------- [2018-11-23 10:49:44,030 INFO L168 Benchmark]: Toolchain (without parser) took 71964.26 ms. Allocated memory was 1.5 GB in the beginning and 2.8 GB in the end (delta: 1.2 GB). Free memory was 1.4 GB in the beginning and 2.4 GB in the end (delta: -988.4 MB). Peak memory consumption was 256.2 MB. Max. memory is 7.1 GB. [2018-11-23 10:49:44,031 INFO L168 Benchmark]: CDTParser took 0.21 ms. Allocated memory is still 1.5 GB. Free memory is still 1.5 GB. There was no memory consumed. Max. memory is 7.1 GB. [2018-11-23 10:49:44,031 INFO L168 Benchmark]: CACSL2BoogieTranslator took 651.80 ms. Allocated memory is still 1.5 GB. Free memory was 1.4 GB in the beginning and 1.4 GB in the end (delta: 23.8 MB). Peak memory consumption was 23.8 MB. Max. memory is 7.1 GB. [2018-11-23 10:49:44,032 INFO L168 Benchmark]: Boogie Procedure Inliner took 122.90 ms. Allocated memory was 1.5 GB in the beginning and 2.3 GB in the end (delta: 735.1 MB). Free memory was 1.4 GB in the beginning and 2.2 GB in the end (delta: -805.9 MB). Peak memory consumption was 16.3 MB. Max. memory is 7.1 GB. [2018-11-23 10:49:44,032 INFO L168 Benchmark]: Boogie Preprocessor took 107.81 ms. Allocated memory is still 2.3 GB. Free memory is still 2.2 GB. There was no memory consumed. Max. memory is 7.1 GB. [2018-11-23 10:49:44,032 INFO L168 Benchmark]: RCFGBuilder took 3040.54 ms. Allocated memory is still 2.3 GB. Free memory was 2.2 GB in the beginning and 2.1 GB in the end (delta: 115.5 MB). Peak memory consumption was 115.5 MB. Max. memory is 7.1 GB. [2018-11-23 10:49:44,033 INFO L168 Benchmark]: TraceAbstraction took 67796.27 ms. Allocated memory was 2.3 GB in the beginning and 2.8 GB in the end (delta: 509.6 MB). Free memory was 2.1 GB in the beginning and 2.5 GB in the end (delta: -387.7 MB). Peak memory consumption was 121.9 MB. Max. memory is 7.1 GB. [2018-11-23 10:49:44,033 INFO L168 Benchmark]: Witness Printer took 238.15 ms. Allocated memory is still 2.8 GB. Free memory was 2.5 GB in the beginning and 2.4 GB in the end (delta: 65.9 MB). Peak memory consumption was 65.9 MB. Max. memory is 7.1 GB. [2018-11-23 10:49:44,035 INFO L336 ainManager$Toolchain]: ####################### End [Toolchain 1] ####################### --- Results --- * Results from de.uni_freiburg.informatik.ultimate.core: - GenericResult: Assertions are enabled Assertions are enabled - StatisticsResult: Toolchain Benchmarks Benchmark results are: * CDTParser took 0.21 ms. Allocated memory is still 1.5 GB. Free memory is still 1.5 GB. There was no memory consumed. Max. memory is 7.1 GB. * CACSL2BoogieTranslator took 651.80 ms. Allocated memory is still 1.5 GB. Free memory was 1.4 GB in the beginning and 1.4 GB in the end (delta: 23.8 MB). Peak memory consumption was 23.8 MB. Max. memory is 7.1 GB. * Boogie Procedure Inliner took 122.90 ms. Allocated memory was 1.5 GB in the beginning and 2.3 GB in the end (delta: 735.1 MB). Free memory was 1.4 GB in the beginning and 2.2 GB in the end (delta: -805.9 MB). Peak memory consumption was 16.3 MB. Max. memory is 7.1 GB. * Boogie Preprocessor took 107.81 ms. Allocated memory is still 2.3 GB. Free memory is still 2.2 GB. There was no memory consumed. Max. memory is 7.1 GB. * RCFGBuilder took 3040.54 ms. Allocated memory is still 2.3 GB. Free memory was 2.2 GB in the beginning and 2.1 GB in the end (delta: 115.5 MB). Peak memory consumption was 115.5 MB. Max. memory is 7.1 GB. * TraceAbstraction took 67796.27 ms. Allocated memory was 2.3 GB in the beginning and 2.8 GB in the end (delta: 509.6 MB). Free memory was 2.1 GB in the beginning and 2.5 GB in the end (delta: -387.7 MB). Peak memory consumption was 121.9 MB. Max. memory is 7.1 GB. * Witness Printer took 238.15 ms. Allocated memory is still 2.8 GB. Free memory was 2.5 GB in the beginning and 2.4 GB in the end (delta: 65.9 MB). Peak memory consumption was 65.9 MB. Max. memory is 7.1 GB. * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction: - CounterExampleResult [Line: 1012]: a call of __VERIFIER_error() is reachable a call of __VERIFIER_error() is reachable We found a FailurePath: [L22] int KernelMode ; [L23] int Executive ; [L24] int DevicePowerState ; [L25] int s ; [L26] int UNLOADED ; [L27] int NP ; [L28] int DC ; [L29] int SKIP1 ; [L30] int SKIP2 ; [L31] int MPR1 ; [L32] int MPR3 ; [L33] int IPC ; [L34] int pended ; [L35] int compFptr ; [L36] int compRegistered ; [L37] int lowerDriverReturn ; [L38] int setEventCalled ; [L39] int customIrp ; [L40] int myStatus ; VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=0, DevicePowerState=0, Executive=0, IPC=0, KernelMode=0, lowerDriverReturn=0, MPR1=0, MPR3=0, myStatus=0, NP=0, pended=0, s=0, setEventCalled=0, SKIP1=0, SKIP2=0, UNLOADED=0] [L293] int status ; [L294] int irp = __VERIFIER_nondet_int() ; [L295] int pirp ; [L296] int pirp__IoStatus__Status ; [L297] int irp_choice = __VERIFIER_nondet_int() ; [L298] int devobj = __VERIFIER_nondet_int() ; [L299] int __cil_tmp8 ; [L301] KernelMode = 0 [L302] Executive = 0 [L303] DevicePowerState = 1 [L304] s = 0 [L305] UNLOADED = 0 [L306] NP = 0 [L307] DC = 0 [L308] SKIP1 = 0 [L309] SKIP2 = 0 [L310] MPR1 = 0 [L311] MPR3 = 0 [L312] IPC = 0 [L313] pended = 0 [L314] compFptr = 0 [L315] compRegistered = 0 [L316] lowerDriverReturn = 0 [L317] setEventCalled = 0 [L318] customIrp = 0 [L319] myStatus = 0 [L323] status = 0 [L324] pirp = irp VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=0, DevicePowerState=1, devobj=0, Executive=0, IPC=0, irp=0, irp_choice=1, KernelMode=0, lowerDriverReturn=0, MPR1=0, MPR3=0, myStatus=0, NP=0, pended=0, pirp=0, s=0, setEventCalled=0, SKIP1=0, SKIP2=0, status=0, UNLOADED=0] [L325] CALL _BLAST_init() VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=0, DevicePowerState=1, Executive=0, IPC=0, KernelMode=0, lowerDriverReturn=0, MPR1=0, MPR3=0, myStatus=0, NP=0, pended=0, s=0, setEventCalled=0, SKIP1=0, SKIP2=0, UNLOADED=0] [L60] UNLOADED = 0 [L61] NP = 1 [L62] DC = 2 [L63] SKIP1 = 3 [L64] SKIP2 = 4 [L65] MPR1 = 5 [L66] MPR3 = 6 [L67] IPC = 7 [L68] s = UNLOADED [L69] pended = 0 [L70] compFptr = 0 [L71] compRegistered = 0 [L72] lowerDriverReturn = 0 [L73] setEventCalled = 0 [L74] customIrp = 0 VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, Executive=0, IPC=7, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=0, setEventCalled=0, SKIP1=3, SKIP2=4, UNLOADED=0] [L325] RET _BLAST_init() VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, devobj=0, Executive=0, IPC=7, irp=0, irp_choice=1, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, pirp=0, s=0, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, UNLOADED=0] [L327] COND TRUE status >= 0 [L328] s = NP [L329] customIrp = 0 [L330] setEventCalled = customIrp [L331] lowerDriverReturn = setEventCalled [L332] compRegistered = lowerDriverReturn [L333] pended = compRegistered [L334] pirp__IoStatus__Status = 0 [L335] myStatus = 0 VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, devobj=0, Executive=0, IPC=7, irp=0, irp_choice=1, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, pirp=0, pirp__IoStatus__Status=0, s=1, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, UNLOADED=0] [L336] COND FALSE !(irp_choice == 0) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, devobj=0, Executive=0, IPC=7, irp=0, irp_choice=1, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, pirp=0, pirp__IoStatus__Status=0, s=1, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, UNLOADED=0] [L341] CALL stub_driver_init() VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=1, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, Executive=0, IPC=7, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=1, setEventCalled=0, SKIP1=3, SKIP2=4, UNLOADED=0] [L46] s = NP [L47] pended = 0 [L48] compFptr = 0 [L49] compRegistered = 0 [L50] lowerDriverReturn = 0 [L51] setEventCalled = 0 [L52] customIrp = 0 VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=1, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, Executive=0, IPC=7, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=1, setEventCalled=0, SKIP1=3, SKIP2=4, UNLOADED=0] [L341] RET stub_driver_init() VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, devobj=0, Executive=0, IPC=7, irp=0, irp_choice=1, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, pirp=0, pirp__IoStatus__Status=0, s=1, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, UNLOADED=0] [L344] COND FALSE !(status < 0) [L348] int tmp_ndt_1; [L349] tmp_ndt_1 = __VERIFIER_nondet_int() [L350] COND FALSE !(tmp_ndt_1 == 0) [L353] int tmp_ndt_2; [L354] tmp_ndt_2 = __VERIFIER_nondet_int() [L355] COND FALSE !(tmp_ndt_2 == 1) [L358] int tmp_ndt_3; [L359] tmp_ndt_3 = __VERIFIER_nondet_int() [L360] COND TRUE tmp_ndt_3 == 3 VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, devobj=0, Executive=0, IPC=7, irp=0, irp_choice=1, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, pirp=0, pirp__IoStatus__Status=0, s=1, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, tmp_ndt_1=1, tmp_ndt_2=0, tmp_ndt_3=3, UNLOADED=0] [L387] CALL, EXPR KbFilter_PnP(devobj, pirp) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=1, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, Executive=0, IPC=7, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=1, setEventCalled=0, SKIP1=3, SKIP2=4, UNLOADED=0] [L79] int devExt ; [L80] int irpStack ; [L81] int status ; [L82] int event = __VERIFIER_nondet_int() ; [L83] int DeviceObject__DeviceExtension = __VERIFIER_nondet_int() ; [L84] int Irp__Tail__Overlay__CurrentStackLocation = __VERIFIER_nondet_int() ; [L85] int irpStack__MinorFunction = __VERIFIER_nondet_int() ; [L86] int devExt__TopOfStack = __VERIFIER_nondet_int() ; [L87] int devExt__Started ; [L88] int devExt__Removed ; [L89] int devExt__SurpriseRemoved ; [L90] int Irp__IoStatus__Status ; [L91] int Irp__IoStatus__Information ; [L92] int Irp__CurrentLocation = __VERIFIER_nondet_int() ; [L93] int irpSp ; [L94] int nextIrpSp ; [L95] int nextIrpSp__Control ; [L96] int irpSp___0 ; [L97] int irpSp__Context ; [L98] int irpSp__Control ; [L99] long __cil_tmp23 ; [L102] status = 0 [L103] devExt = DeviceObject__DeviceExtension [L104] irpStack = Irp__Tail__Overlay__CurrentStackLocation VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=1, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, devExt=0, devExt__TopOfStack=0, DeviceObject=0, DeviceObject__DeviceExtension=0, DevicePowerState=1, event=0, Executive=0, IPC=7, Irp=0, Irp__CurrentLocation=2147483647, Irp__Tail__Overlay__CurrentStackLocation=2147483647, irpStack=2147483647, irpStack__MinorFunction=2, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=1, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, UNLOADED=0] [L105] COND FALSE !(irpStack__MinorFunction == 0) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=1, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, devExt=0, devExt__TopOfStack=0, DeviceObject=0, DeviceObject__DeviceExtension=0, DevicePowerState=1, event=0, Executive=0, IPC=7, Irp=0, Irp__CurrentLocation=2147483647, Irp__Tail__Overlay__CurrentStackLocation=2147483647, irpStack=2147483647, irpStack__MinorFunction=2, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=1, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, UNLOADED=0] [L108] COND FALSE !(irpStack__MinorFunction == 23) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=1, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, devExt=0, devExt__TopOfStack=0, DeviceObject=0, DeviceObject__DeviceExtension=0, DevicePowerState=1, event=0, Executive=0, IPC=7, Irp=0, Irp__CurrentLocation=2147483647, Irp__Tail__Overlay__CurrentStackLocation=2147483647, irpStack=2147483647, irpStack__MinorFunction=2, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=1, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, UNLOADED=0] [L111] COND TRUE irpStack__MinorFunction == 2 VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=1, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, devExt=0, devExt__TopOfStack=0, DeviceObject=0, DeviceObject__DeviceExtension=0, DevicePowerState=1, event=0, Executive=0, IPC=7, Irp=0, Irp__CurrentLocation=2147483647, Irp__Tail__Overlay__CurrentStackLocation=2147483647, irpStack=2147483647, irpStack__MinorFunction=2, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=1, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, UNLOADED=0] [L235] devExt__Removed = 1 VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=1, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, devExt=0, devExt__Removed=1, devExt__TopOfStack=0, DeviceObject=0, DeviceObject__DeviceExtension=0, DevicePowerState=1, event=0, Executive=0, IPC=7, Irp=0, Irp__CurrentLocation=2147483647, Irp__Tail__Overlay__CurrentStackLocation=2147483647, irpStack=2147483647, irpStack__MinorFunction=2, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=1, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, UNLOADED=0] [L236] COND TRUE s == NP [L237] s = SKIP1 VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=1, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, devExt=0, devExt__Removed=1, devExt__TopOfStack=0, DeviceObject=0, DeviceObject__DeviceExtension=0, DevicePowerState=1, event=0, Executive=0, IPC=7, Irp=0, Irp__CurrentLocation=2147483647, Irp__Tail__Overlay__CurrentStackLocation=2147483647, irpStack=2147483647, irpStack__MinorFunction=2, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=3, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, UNLOADED=0] [L244] Irp__CurrentLocation ++ [L245] Irp__Tail__Overlay__CurrentStackLocation ++ VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=1, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, devExt=0, devExt__Removed=1, devExt__TopOfStack=0, DeviceObject=0, DeviceObject__DeviceExtension=0, DevicePowerState=1, event=0, Executive=0, IPC=7, Irp=0, Irp__CurrentLocation=2147483648, Irp__Tail__Overlay__CurrentStackLocation=2147483648, irpStack=2147483647, irpStack__MinorFunction=2, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=3, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, UNLOADED=0] [L246] CALL IofCallDriver(devExt__TopOfStack, Irp) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=3, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, Executive=0, IPC=7, KernelMode=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=3, setEventCalled=0, SKIP1=3, SKIP2=4, UNLOADED=0] [L482] int returnVal2 ; [L483] int compRetStatus ; [L484] int lcontext = __VERIFIER_nondet_int() ; [L485] long long __cil_tmp7 ; VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=3, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DeviceObject=0, DevicePowerState=1, Executive=0, IPC=7, Irp=0, KernelMode=0, lcontext=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=3, setEventCalled=0, SKIP1=3, SKIP2=4, UNLOADED=0] [L488] COND FALSE !(\read(compRegistered)) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=3, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DeviceObject=0, DevicePowerState=1, Executive=0, IPC=7, Irp=0, KernelMode=0, lcontext=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=3, setEventCalled=0, SKIP1=3, SKIP2=4, UNLOADED=0] [L501] int tmp_ndt_6; [L502] tmp_ndt_6 = __VERIFIER_nondet_int() [L503] COND FALSE !(tmp_ndt_6 == 0) [L506] int tmp_ndt_7; [L507] tmp_ndt_7 = __VERIFIER_nondet_int() [L508] COND TRUE tmp_ndt_7 == 1 VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=3, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DeviceObject=0, DevicePowerState=1, Executive=0, IPC=7, Irp=0, KernelMode=0, lcontext=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=3, setEventCalled=0, SKIP1=3, SKIP2=4, tmp_ndt_6=1, tmp_ndt_7=1, UNLOADED=0] [L517] returnVal2 = -1073741823 VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=3, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DeviceObject=0, DevicePowerState=1, Executive=0, IPC=7, Irp=0, KernelMode=0, lcontext=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, returnVal2=3221225473, s=3, setEventCalled=0, SKIP1=3, SKIP2=4, tmp_ndt_6=1, tmp_ndt_7=1, UNLOADED=0] [L527] COND FALSE !(s == NP) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=3, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DeviceObject=0, DevicePowerState=1, Executive=0, IPC=7, Irp=0, KernelMode=0, lcontext=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, returnVal2=3221225473, s=3, setEventCalled=0, SKIP1=3, SKIP2=4, tmp_ndt_6=1, tmp_ndt_7=1, UNLOADED=0] [L531] COND FALSE !(s == MPR1) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=3, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DeviceObject=0, DevicePowerState=1, Executive=0, IPC=7, Irp=0, KernelMode=0, lcontext=0, lowerDriverReturn=0, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, returnVal2=3221225473, s=3, setEventCalled=0, SKIP1=3, SKIP2=4, tmp_ndt_6=1, tmp_ndt_7=1, UNLOADED=0] [L540] COND TRUE s == SKIP1 [L541] s = SKIP2 [L542] lowerDriverReturn = returnVal2 VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=3, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DeviceObject=0, DevicePowerState=1, Executive=0, IPC=7, Irp=0, KernelMode=0, lcontext=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, returnVal2=3221225473, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, tmp_ndt_6=1, tmp_ndt_7=1, UNLOADED=0] [L550] return (returnVal2); VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=3, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, \result=-1073741823, compFptr=0, compRegistered=0, customIrp=0, DC=2, DeviceObject=0, DevicePowerState=1, Executive=0, IPC=7, Irp=0, KernelMode=0, lcontext=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, returnVal2=3221225473, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, tmp_ndt_6=1, tmp_ndt_7=1, UNLOADED=0] [L246] RET IofCallDriver(devExt__TopOfStack, Irp) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=1, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, devExt=0, devExt__Removed=1, devExt__TopOfStack=0, DeviceObject=0, DeviceObject__DeviceExtension=0, DevicePowerState=1, event=0, Executive=0, IofCallDriver(devExt__TopOfStack, Irp)=-1073741823, IPC=7, Irp=0, Irp__CurrentLocation=2147483648, Irp__Tail__Overlay__CurrentStackLocation=2147483648, irpStack=2147483647, irpStack__MinorFunction=2, KernelMode=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, UNLOADED=0] [L247] status = 0 VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=1, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, devExt=0, devExt__Removed=1, devExt__TopOfStack=0, DeviceObject=0, DeviceObject__DeviceExtension=0, DevicePowerState=1, event=0, Executive=0, IPC=7, Irp=0, Irp__CurrentLocation=2147483648, Irp__Tail__Overlay__CurrentStackLocation=2147483648, irpStack=2147483647, irpStack__MinorFunction=2, KernelMode=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, UNLOADED=0] [L289] return (status); VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DeviceObject)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(Irp)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=1, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, \result=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, devExt=0, devExt__Removed=1, devExt__TopOfStack=0, DeviceObject=0, DeviceObject__DeviceExtension=0, DevicePowerState=1, event=0, Executive=0, IPC=7, Irp=0, Irp__CurrentLocation=2147483648, Irp__Tail__Overlay__CurrentStackLocation=2147483648, irpStack=2147483647, irpStack__MinorFunction=2, KernelMode=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, UNLOADED=0] [L387] RET, EXPR KbFilter_PnP(devobj, pirp) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, devobj=0, Executive=0, IPC=7, irp=0, irp_choice=1, KbFilter_PnP(devobj, pirp)=0, KernelMode=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, pirp=0, pirp__IoStatus__Status=0, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, tmp_ndt_1=1, tmp_ndt_2=0, tmp_ndt_3=3, UNLOADED=0] [L387] status = KbFilter_PnP(devobj, pirp) [L411] COND FALSE !(pended == 1) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, devobj=0, Executive=0, IPC=7, irp=0, irp_choice=1, KernelMode=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, pirp=0, pirp__IoStatus__Status=0, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, tmp_ndt_1=1, tmp_ndt_2=0, tmp_ndt_3=3, UNLOADED=0] [L419] COND FALSE !(pended == 1) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, devobj=0, Executive=0, IPC=7, irp=0, irp_choice=1, KernelMode=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, pirp=0, pirp__IoStatus__Status=0, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, tmp_ndt_1=1, tmp_ndt_2=0, tmp_ndt_3=3, UNLOADED=0] [L427] COND TRUE s != UNLOADED VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, devobj=0, Executive=0, IPC=7, irp=0, irp_choice=1, KernelMode=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, pirp=0, pirp__IoStatus__Status=0, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, tmp_ndt_1=1, tmp_ndt_2=0, tmp_ndt_3=3, UNLOADED=0] [L428] COND TRUE status != -1 VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, devobj=0, Executive=0, IPC=7, irp=0, irp_choice=1, KernelMode=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, pirp=0, pirp__IoStatus__Status=0, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, tmp_ndt_1=1, tmp_ndt_2=0, tmp_ndt_3=3, UNLOADED=0] [L429] COND FALSE !(s != SKIP2) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, devobj=0, Executive=0, IPC=7, irp=0, irp_choice=1, KernelMode=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, pirp=0, pirp__IoStatus__Status=0, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, tmp_ndt_1=1, tmp_ndt_2=0, tmp_ndt_3=3, UNLOADED=0] [L439] COND FALSE !(pended == 1) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, devobj=0, Executive=0, IPC=7, irp=0, irp_choice=1, KernelMode=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, pirp=0, pirp__IoStatus__Status=0, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, tmp_ndt_1=1, tmp_ndt_2=0, tmp_ndt_3=3, UNLOADED=0] [L446] COND FALSE !(s == DC) VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, devobj=0, Executive=0, IPC=7, irp=0, irp_choice=1, KernelMode=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, pirp=0, pirp__IoStatus__Status=0, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, tmp_ndt_1=1, tmp_ndt_2=0, tmp_ndt_3=3, UNLOADED=0] [L451] COND TRUE status != lowerDriverReturn VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, devobj=0, Executive=0, IPC=7, irp=0, irp_choice=1, KernelMode=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, pirp=0, pirp__IoStatus__Status=0, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, status=0, tmp_ndt_1=1, tmp_ndt_2=0, tmp_ndt_3=3, UNLOADED=0] [L452] CALL errorFn() VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, Executive=0, IPC=7, KernelMode=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, UNLOADED=0] [L1012] __VERIFIER_error() VAL [\old(compFptr)=0, \old(compRegistered)=0, \old(customIrp)=0, \old(DC)=0, \old(DevicePowerState)=0, \old(Executive)=0, \old(IPC)=0, \old(KernelMode)=0, \old(lowerDriverReturn)=0, \old(MPR1)=0, \old(MPR3)=0, \old(myStatus)=0, \old(NP)=0, \old(pended)=0, \old(s)=0, \old(setEventCalled)=0, \old(SKIP1)=0, \old(SKIP2)=0, \old(UNLOADED)=0, compFptr=0, compRegistered=0, customIrp=0, DC=2, DevicePowerState=1, Executive=0, IPC=7, KernelMode=0, lowerDriverReturn=3221225473, MPR1=5, MPR3=6, myStatus=0, NP=1, pended=0, s=4, setEventCalled=0, SKIP1=3, SKIP2=4, UNLOADED=0] - StatisticsResult: Ultimate Automizer benchmark data CFG has 18 procedures, 252 locations, 1 error locations. UNSAFE Result, 67.6s OverallTime, 18 OverallIterations, 1 TraceHistogramMax, 51.4s AutomataDifference, 0.0s DeadEndRemovalTime, 0.0s HoareAnnotationTime, HoareTripleCheckerStatistics: 4747 SDtfs, 1713 SDslu, 11396 SDs, 0 SdLazy, 1578 SolverSat, 194 SolverUnsat, 0 SolverUnknown, 0 SolverNotchecked, 3.4s Time, PredicateUnifierStatistics: 0 DeclaredPredicates, 784 GetRequests, 711 SyntacticMatches, 2 SemanticMatches, 71 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 8 ImplicationChecksByTransitivity, 0.7s Time, 0.0s BasicInterpolantAutomatonTime, BiggestAbstraction: size=349occurred in iteration=5, traceCheckStatistics: No data available, InterpolantConsolidationStatistics: No data available, PathInvariantsStatistics: No data available, 0/0 InterpolantCoveringCapability, TotalInterpolationStatistics: No data available, 0.0s AbstIntTime, 0 AbstIntIterations, 0 AbstIntStrong, NaN AbsIntWeakeningRatio, NaN AbsIntAvgWeakeningVarsNumRemoved, NaN AbsIntAvgWeakenedConjuncts, 0.0s DumpTime, AutomataMinimizationStatistics: 6.9s AutomataMinimizationTime, 17 MinimizatonAttempts, 190 StatesRemovedByMinimization, 7 NontrivialMinimizations, HoareAnnotationStatistics: No data available, RefinementEngineStatistics: TraceCheckStatistics: 0.5s SsaConstructionTime, 1.1s SatisfiabilityAnalysisTime, 4.8s InterpolantComputationTime, 844 NumberOfCodeBlocks, 844 NumberOfCodeBlocksAsserted, 18 NumberOfCheckSat, 771 ConstructedInterpolants, 0 QuantifiedInterpolants, 69875 SizeOfPredicates, 21 NumberOfNonLiveVariables, 4720 ConjunctsInSsa, 90 ConjunctsInUnsatCore, 17 InterpolantComputations, 17 PerfectInterpolantSequences, 0/0 InterpolantCoveringCapability, InvariantSynthesisStatistics: No data available, InterpolantConsolidationStatistics: No data available, ReuseStatistics: No data available RESULT: Ultimate proved your program to be incorrect! Received shutdown request...